{
  "format": "rulemetric-supabase-rls-public-evidence-v1",
  "analysisSourceHashes": {
    "collect-report.py": "eb46b3f248881b0943f2c210b05edcd07f7cceaa95604c92b4ca02372a2ddbf3",
    "build-sensitivity-v2.py": "4631c217824aa4af9411a3423f37d2a858a62cde1024f689cfbf3b94086afb5b",
    "campaign-monitor.py": "a02e00e4b086be5dba86c595f53841806e1a38bd156cebef25298c7a9f757f5f",
    "render-study.py": "fc0875e53d8f2ab7da1f7d2607c3444f0a3bf0101c16ed992300edd8ba45c914",
    "capture-audit.py": "e0077d0e1cf862b49ec11284fc5701903e99b0190ca8a469ab403db46dc80c07",
    "build-sensitivity.py": "09b7108c515385e046f1d7cb8c2e6b959ff5a609e5239d5b55551f2249b6b0fb",
    "sensitivity-replay-v2.py": "6a66a19310fdf35a904d740e005ce4b108ff2ca2a6448302957b7f5a4a4dfe51",
    "verify-browser.mjs": "5f1d18b15ddcdb5f4ff92c94320f6c5a7f4131bfca3ee199e8c0eb8f889a0480",
    "write-local-drafts.py": "eeed5b90d1dbe595e21ac7aebdd956d5074d3a49dd46e6e1b14d9aa5c1f2f50e",
    "sensitivity-replay.py": "1d1b3d9bbaeec153c1e72f39d6e25be08b7b52861ff7f212501dc029e42e9497",
    "stage-publication.py": "00ed7b48f4d1cb300d854dba590dde03e91ad08f6b7c6f6eafe1c1a171a38386",
    "verify-evidence.py": "3d31b0039e77cb2c5280118c63c304474921ac07832acbf6e51ab5dfe6594de2",
    "public-replay.py": "30dcf2c3473e7a9a99edb22b9820facc1c7500aa1c28829bf92aa0d474c115ac"
  },
  "analysisCommit": "375e1c805325e764d275fd773663f7ebc7fb6668",
  "generatedAt": "2026-10-27T04:10:04.063048+00:00",
  "status": "completed and replayed",
  "scope": "Three authored synthetic application families; two repetitions and two stages per arm; explicit skill delivery; separate native subscription model/harness/policy cohorts. Descriptive pilot, no population efficacy, equivalence, adoption, or cross-model ranking claim.",
  "candidate": {
    "repository": "https://github.com/supabase/agent-skills",
    "commit": "c9be0e931b7930f7d02126d04774d904c381e7d7",
    "skill": "supabase-postgres-best-practices",
    "hashes": {
      "CHANGELOG.md": "751ad110037c85d400018c9894716a04fa46357ff55c22b1169b280752e19e88",
      "SKILL.md": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
      "references/_contributing.md": "191e039e7d94764e6073410b513b559f9a594e0fdf0252a30c2a2986df2ab3bc",
      "references/_sections.md": "c9e992612b422c7122de0b7542ebc2450db283edaab08cfe86c6d657fcccccd5",
      "references/_template.md": "6299954250f212caabe339d752c3e5313a8e07d1a182a4e4b425baee91df1bd2",
      "references/advanced-full-text-search.md": "40c2606bbb4c4dce31308f201b24cc7f58c7df05b1d9c6856fe2b888d3b7cf28",
      "references/advanced-jsonb-indexing.md": "24cacf6a8bc35901dd566d24502ce8e57f810a5c196b897e61d52726e521d106",
      "references/conn-idle-timeout.md": "630588902c00fcec59a5988cc5d042f76dcf2c923a535abfd8c47dca205eaed5",
      "references/conn-limits.md": "11b2a67a7c7679cbbc5d807bbb17e69c98484a581d0c8b929c03408f412b81b2",
      "references/conn-pooling.md": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
      "references/conn-prepared-statements.md": "174e9332fe3dda5c99b2b00159fb1915ae36c00bab3a7882c14e73e4344e946e",
      "references/data-batch-inserts.md": "531933b82d6a622d0fae29e0ea80be6fe5d78655adf2804c271ea84a1930de37",
      "references/data-n-plus-one.md": "21a44905e5b16a42741892ec34bb1bfef124d049b140a76934a9acd0f46f5fc2",
      "references/data-pagination.md": "73c9fa10a3d439bedea0e11b640bd25bf30dd50f0d9006cf85baf7c3151543fa",
      "references/data-upsert.md": "2612af83b20a2701dde30ef1f8d7efd26b7e9eef84717226b8f038a2d2150ff7",
      "references/lock-advisory.md": "c88d259dbf81c3771438f59a165f7eab8acd09999dd370bdf807521c73f35aab",
      "references/lock-deadlock-prevention.md": "09aee46f51d7178c8e55fe056cd5a94a64ba2c122fe418e6900cd99f297b2347",
      "references/lock-short-transactions.md": "5aa7f61095916986d39644b446cdbcd2bacca7ef698a3bb50b3f82dd60207602",
      "references/lock-skip-locked.md": "6c45077f430f29cd9cd8f448c94d578e827e7bd023fcdaf717a756acb116fa4b",
      "references/monitor-explain-analyze.md": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
      "references/monitor-pg-stat-statements.md": "89dca99d4e894fcbdcac136be7ad9fbc03d1342904f065c1b198dc9cf495f098",
      "references/monitor-vacuum-analyze.md": "2892272011710eb49b3f185ec12f15ce9ce4c365792c672f6e2a9c90da426a1a",
      "references/query-composite-indexes.md": "73e42424e671f0266e74fdb220db3196790f69fb43e2b19c7b9483eb4971b554",
      "references/query-covering-indexes.md": "daf2a7f0477fb7357b62b5fb5b185b1995a77a186347e45cb780e25e7a7589b6",
      "references/query-index-types.md": "472a74f22c2df203bd0154999b3a5a0187cca2ab3d9a3978e305bb7c32f1a282",
      "references/query-missing-indexes.md": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
      "references/query-partial-indexes.md": "6448982bc8558c6555284958edc331b29239c6a0130e6b4501dd6d4da607a6dd",
      "references/schema-constraints.md": "90e8efda3e9e81095e642911ad4aae2809d160f29414338fa997253238f510f8",
      "references/schema-data-types.md": "e01b58c14c7f3f65d8ead580b9a4fcf70b83baaab0f9a5f83c569c9fd113e8c8",
      "references/schema-foreign-key-indexes.md": "7587713d12a65a212365459b3d39e4717d8a79e4073b10bd62f1054d8192c0dd",
      "references/schema-lowercase-identifiers.md": "4bc80f70865f2390872591f326c8a6be6456a0aeb5a7e5a2475d7cd9d43059ab",
      "references/schema-partitioning.md": "541e13fbeaf4bb1485c9059d4c9417dbdb766cf16f4237cd63a04ada7ec45b90",
      "references/schema-primary-keys.md": "3c8beabef82066f9a0838b926da0885117fd2d9a263aaf84cb5ca9e5f0d400e9",
      "references/security-privileges.md": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
      "references/security-rls-basics.md": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
      "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014"
    }
  },
  "phases": [
    {
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "createdAt": "2026-10-26T15:32:27.111654-07:00",
      "sourceCommit": "458df0feb15cff2a587722fc2d834bec4e731b2d",
      "sourceHashes": {
        "scripts/harbor/container_command.py": "50e6a59cbd1cbe203a8c413607efba22d46fa04fcdf285e27ba0bb23350218ec",
        "scripts/harbor/container_tools.py": "bca27a78bbdb1abea06bae9788e91653e443fe69437d3236181d87ed86262445",
        "scripts/harbor/cost_delta.py": "3cf7b735b0fd1799a7b6f338638c61e0a8b756df73d7136bc6a8a731c0c6ddac",
        "scripts/harbor/diagnose_container.py": "ce068e533594fe4d1105ceb1a44a94e5fe61162501b0cc8a6c0a437db5a6eafc",
        "scripts/harbor/mcp_container_shell.py": "6452659c91a523053a7e19ae8e893ee89acf60d169147d7c3d7adcf05912b44a",
        "scripts/harbor/mcp_owned_container.py": "620f9f4aee54912e0f6c06f071a3532f972b40dddddacbebcd842c931eeebe84",
        "scripts/harbor/memory_study/__init__.py": "1fcc4f3c58e6d23032beee7cd2180540a765632051a41d2ea28302eb06bd1d61",
        "scripts/harbor/memory_study/__main__.py": "47397f23e5a5b29cc41b20dd562cc58f09af4c96e370c811a9c8eb78ff94ca8f",
        "scripts/harbor/memory_study/agent.py": "c5cd2145e253db94a272385cc4c907d4647705e58f8d3fb6990ce469dead9f85",
        "scripts/harbor/memory_study/analysis.py": "145390e8eb8bac8d46769be7da655b238b2893bbe8c85053812559898dfc3f71",
        "scripts/harbor/memory_study/budget.py": "edb5aefa4d5564acf4a5183d063c66209629851752b73cd706959dffeb55064a",
        "scripts/harbor/memory_study/cleanup.py": "771138a5775ab6d9f352f36880f8d70a338d157961155190c6951b64141a5dc5",
        "scripts/harbor/memory_study/codex_subscription.py": "50814e8008c8b772cb2ec3921175ce0ef4582ff30473f92f4f3523dc73323e29",
        "scripts/harbor/memory_study/harness.py": "89cd79a1f412adde8d5691e249b4d8a235576dd69c4162a703e753cb7a754309",
        "scripts/harbor/memory_study/native_controls.py": "ae8d447a986357d83f39791b614ae5e692fd5d7910dccd49237963d3b267aaa2",
        "scripts/harbor/memory_study/prepare.py": "f06c33f70044b6021652dffd90178636f90170316f7bf11c7de269e4cb54c531",
        "scripts/harbor/memory_study/protocol.py": "9d3e3a60344f90b6228a44bab783ec8262011a7bb87116f2a5740fb97f91d452",
        "scripts/harbor/memory_study/providers.py": "86d386ffe9be82eb3ca77cf84a383f5d55b1dea706dd3d1a870f9db01f657e0b",
        "scripts/harbor/memory_study/qualification.py": "51077c97bfaccb9f12f7b105846b1ede98fa70f7b5e13269dafeb46444df975d",
        "scripts/harbor/memory_study/sdk_controls.py": "d997f4b6f2a97034a2619ad2f8369c1e7a96e1b8595fb5f9ad04d7c9a937ead9",
        "scripts/harbor/memory_study/subscription.py": "96faf2029f4f5c8d42da20ee075221e93fc64917a7db794d5eea8e191ef76d02",
        "scripts/harbor/memory_study/test_study.py": "d5c2138612bf0df7358435749283fa070bc8f151207546c57b86892ae38a306b",
        "scripts/harbor/memory_study/test_subscription.py": "7ec1f375c98c83e13972bb9cfd7dd44705122c635c2211498f8955de0c6c099e",
        "scripts/harbor/memory_study/usage.py": "a14997afba9521d93db78ad2976e6389afc0edebd1469b71d0833ea88616fcc8",
        "scripts/harbor/provenance.py": "d3e35635753e8d1fcebc817e268ffc3c3786c3851fa530305db7c6896e5cfc9b",
        "scripts/harbor/rm-batch-task/tests/test_outputs.py": "746d98ebaad8c622bc93e584843dfe2594db5ae0a357386fafb26f93159bc2b8",
        "scripts/harbor/rm-container-task/tests/test_outputs.py": "693dbacadce5d164ab6c2d93f5d32b416fb438652a152705744d30ee0f9aeedc",
        "scripts/harbor/rm-locality-task/environment/workspace/packages/shared/defaults.py": "cd86a842f705a1b676b83e51033229401280615e213abe9d864f923c2fb117d7",
        "scripts/harbor/rm-locality-task/environment/workspace/services/ingest/loader.py": "f147fd8738510495077588a188c08720b818e8598256cc05869cdf18f18d21c3",
        "scripts/harbor/rm-locality-task/tests/test_outputs.py": "f6b0e96da6541a54558c66d51d6f5fc94bcb63cc70bd8af472a106b73b581cef",
        "scripts/harbor/rm-migrations-task/tests/test_outputs.py": "7efa6b6c82855fd55afa2b1f413ecccf7815a9e0c886507621d41edf05ca9847",
        "scripts/harbor/rm-pagination-task/environment/store.py": "8ebc0595a6dd280fc9f64a67fe4685bd2017ddd9e95024f2e0c57fec66d55df2",
        "scripts/harbor/rm-pagination-task/tests/test_outputs.py": "ebf17e883f54b0998665d85f80719a0ded6dd9365ccfd2d9be47837387514a13",
        "scripts/harbor/rm-proto-task/tests/test_outputs.py": "535b19ec03aa5d7b457d8594f1fa556ed9b19937aedc56dc4e2fa2cb5454b249",
        "scripts/harbor/rm-recovery-task/environment/recover.py": "724bb8108cd28c7bdbc4727f0c71a4ebe76591954594689929db40c8e84546a9",
        "scripts/harbor/rm-recovery-task/solution/recover.py": "5ba7b97a75118155f59bd435cc99356cc1c382221217654be08eb8841c332c66",
        "scripts/harbor/rm-recovery-task/tests/test_outputs.py": "4edc13bbc2657c994406e80f9827fd610484a67929a2ef1369fc14152802268e",
        "scripts/harbor/rm_host_claude.py": "96d8a60b0114f6321f6f68d87cc8cb4e8e96f0c37302de4848ef75ac6c364b27",
        "scripts/harbor/rm_host_codex.py": "f44aa88c14dfe651d3e8caea131c49f0cea2ebbc53ea2d5b134ccdd67da03a00",
        "scripts/harbor/rm_host_container.py": "6bb5f9c2e2f4fc7dd17935ade7ee74890da68c6cd655d6ba56e63fb670386900",
        "scripts/harbor/rm_host_pi.py": "2738ae8655af0eca0871c41b54f35023b8b832535c3d5afab792f3830c48cd19",
        "scripts/harbor/rm_native_codex.py": "af7b37c7420b2f33d18d5df74bfca576c5a1c3fe58948582169f9d5b35b9a002",
        "scripts/harbor/summarize.py": "6d0f8dc291e9e49b201a560e34e36f5c43d3bff6ec66d52082b006f3fddd1b39",
        "scripts/harbor/test_full_parity_codex_config.py": "bcd51896601a1da8aaee406bc63eafc29f3a64e7b32268986463ab89a5217d11",
        "scripts/harbor/test_full_parity_pi.py": "1d95c4548060db9c590abadfe14f0b39b13c453d61cb14c856d54f0617d3221a",
        "scripts/harbor/test_native_codex.py": "05bd883ab88d2f6fbdcb2c17a935bcc34294fa3604fea03934bbf3a699be9c0c",
        "scripts/harbor/verdict_bridge.py": "999ccd8c382d69a3c1bc9ae435cca6e5e498ab98dfea601d37636563bb2119c6",
        "scripts/studies/supabase_rls/__init__.py": "ed3b61a97c9741f9862614bc18c8b634239b0f18b31b02820985432c488afe55",
        "scripts/studies/supabase_rls/database.py": "57758593dadae5c6d188281882373430cb5cc156c7123210c2e97e8077be06d3",
        "scripts/studies/supabase_rls/fixtures.py": "13e04472c6fffbaa0712a6eaa625845d690c453d274050c29c9111a0e27f148a",
        "scripts/studies/supabase_rls/grader.py": "94cafe8ad11a88750f521b5cdb3a6bc66d58e2505490be4e5410bde75bc2c98a",
        "scripts/studies/supabase_rls/runner.py": "6bec997f463911ae5b5b16323ffadf966de87bc152c44035e1d9b3ee44f8eb86",
        "scripts/studies/supabase_rls/test_study.py": "eec4d18e5848d1d70867f30a3e25ef24ef302a76fc3abfbf3351589a2006a12a"
      },
      "skillCommit": "c9be0e931b7930f7d02126d04774d904c381e7d7",
      "skillHashes": {
        "CHANGELOG.md": "751ad110037c85d400018c9894716a04fa46357ff55c22b1169b280752e19e88",
        "SKILL.md": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
        "references/_contributing.md": "191e039e7d94764e6073410b513b559f9a594e0fdf0252a30c2a2986df2ab3bc",
        "references/_sections.md": "c9e992612b422c7122de0b7542ebc2450db283edaab08cfe86c6d657fcccccd5",
        "references/_template.md": "6299954250f212caabe339d752c3e5313a8e07d1a182a4e4b425baee91df1bd2",
        "references/advanced-full-text-search.md": "40c2606bbb4c4dce31308f201b24cc7f58c7df05b1d9c6856fe2b888d3b7cf28",
        "references/advanced-jsonb-indexing.md": "24cacf6a8bc35901dd566d24502ce8e57f810a5c196b897e61d52726e521d106",
        "references/conn-idle-timeout.md": "630588902c00fcec59a5988cc5d042f76dcf2c923a535abfd8c47dca205eaed5",
        "references/conn-limits.md": "11b2a67a7c7679cbbc5d807bbb17e69c98484a581d0c8b929c03408f412b81b2",
        "references/conn-pooling.md": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
        "references/conn-prepared-statements.md": "174e9332fe3dda5c99b2b00159fb1915ae36c00bab3a7882c14e73e4344e946e",
        "references/data-batch-inserts.md": "531933b82d6a622d0fae29e0ea80be6fe5d78655adf2804c271ea84a1930de37",
        "references/data-n-plus-one.md": "21a44905e5b16a42741892ec34bb1bfef124d049b140a76934a9acd0f46f5fc2",
        "references/data-pagination.md": "73c9fa10a3d439bedea0e11b640bd25bf30dd50f0d9006cf85baf7c3151543fa",
        "references/data-upsert.md": "2612af83b20a2701dde30ef1f8d7efd26b7e9eef84717226b8f038a2d2150ff7",
        "references/lock-advisory.md": "c88d259dbf81c3771438f59a165f7eab8acd09999dd370bdf807521c73f35aab",
        "references/lock-deadlock-prevention.md": "09aee46f51d7178c8e55fe056cd5a94a64ba2c122fe418e6900cd99f297b2347",
        "references/lock-short-transactions.md": "5aa7f61095916986d39644b446cdbcd2bacca7ef698a3bb50b3f82dd60207602",
        "references/lock-skip-locked.md": "6c45077f430f29cd9cd8f448c94d578e827e7bd023fcdaf717a756acb116fa4b",
        "references/monitor-explain-analyze.md": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
        "references/monitor-pg-stat-statements.md": "89dca99d4e894fcbdcac136be7ad9fbc03d1342904f065c1b198dc9cf495f098",
        "references/monitor-vacuum-analyze.md": "2892272011710eb49b3f185ec12f15ce9ce4c365792c672f6e2a9c90da426a1a",
        "references/query-composite-indexes.md": "73e42424e671f0266e74fdb220db3196790f69fb43e2b19c7b9483eb4971b554",
        "references/query-covering-indexes.md": "daf2a7f0477fb7357b62b5fb5b185b1995a77a186347e45cb780e25e7a7589b6",
        "references/query-index-types.md": "472a74f22c2df203bd0154999b3a5a0187cca2ab3d9a3978e305bb7c32f1a282",
        "references/query-missing-indexes.md": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
        "references/query-partial-indexes.md": "6448982bc8558c6555284958edc331b29239c6a0130e6b4501dd6d4da607a6dd",
        "references/schema-constraints.md": "90e8efda3e9e81095e642911ad4aae2809d160f29414338fa997253238f510f8",
        "references/schema-data-types.md": "e01b58c14c7f3f65d8ead580b9a4fcf70b83baaab0f9a5f83c569c9fd113e8c8",
        "references/schema-foreign-key-indexes.md": "7587713d12a65a212365459b3d39e4717d8a79e4073b10bd62f1054d8192c0dd",
        "references/schema-lowercase-identifiers.md": "4bc80f70865f2390872591f326c8a6be6456a0aeb5a7e5a2475d7cd9d43059ab",
        "references/schema-partitioning.md": "541e13fbeaf4bb1485c9059d4c9417dbdb766cf16f4237cd63a04ada7ec45b90",
        "references/schema-primary-keys.md": "3c8beabef82066f9a0838b926da0885117fd2d9a263aaf84cb5ca9e5f0d400e9",
        "references/security-privileges.md": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
        "references/security-rls-basics.md": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
        "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014"
      },
      "docsHashes": {
        "postgres-17-rls.html": "4a192371e7ca0227a41ed822a46b6b25cee7cb43ece298b291264452481c9ee2",
        "supabase-rls.md": "b0b81f8b7f72e8fbd9e83314b9e4d1b658827754bfe9d469e0ec3a243a0029c0"
      },
      "schemaSha256": "f208daf6b08ca4a6d80a69abb983f062ad4a68c22a0d3e025ef51e58fbbd50d6",
      "promptHashes": {
        "tenant-records/1/baseline": "29c14bf96614bc48efc8e4ad93cb553eeeff1f03cbd4a14da9753783b9f3e305",
        "tenant-records/1/skill": "0e5521c05e2fb24a325715dad6800a519f289f6b2b6b222bc4db77e0f9d3e8c2",
        "tenant-records/2/baseline": "2bb3029150baa9ababc3cbf68859c59eac2cac9849c6f2ecd8c4ec914700aaea",
        "tenant-records/2/skill": "2bd1eb603eeadb8bf0c7cc6ed97cf975230f7fc764a959b7a8a2c06ffebcaceb",
        "document-sharing/1/baseline": "4a896d4196697757ec47d14c278b79b9f46508e9ef8768ca630ff372c2141dab",
        "document-sharing/1/skill": "589ffd6f7bcfa19fb449572fc19a16faf67abd048d5464d69c47e4674811abcf",
        "document-sharing/2/baseline": "398e5ba7a948e5616e9fb69664b045c6c512115f3cb1e273554abd492dd94b57",
        "document-sharing/2/skill": "0503680d6ffd39b9aab2e6c27d992e2a2170f2bea6a5014e1d064a215fe55db5",
        "public-catalog/1/baseline": "6ec799e9a9ae5937b9dff22f4074aedb379d73a1a5fd6c52f896fa293b08fc85",
        "public-catalog/1/skill": "5a8d24197fc347c34dcaac4cdb5e728c8826ab84d3a2c1ccf15f9219234d16ba",
        "public-catalog/2/baseline": "00f7283b91509cbe46deba9f9fa21c9aaefede05ac4a1ec640916a45569bf38a",
        "public-catalog/2/skill": "5df4f86c12cb792120abd7f59dbc9fa1b465c081b5b804c6769d3ad6b6c15fdc"
      },
      "imageReference": "public.ecr.aws/supabase/postgres@sha256:82a04ba6c05f60950a74ae46be3726abb18d06ee44da936276fd782e72e36855",
      "imageId": "sha256:d7eb0927f0a64ee80e11debd191c133dbb077da9ce7b0b7ca6bac660ba51b5ca",
      "budgets": {
        "plannedCodingSessions": 48,
        "qualificationSessions": 4,
        "secondsPerSession": 600,
        "maxTurnsClaude": 40,
        "maxContainerCommands": 60,
        "maxObservedTokens": 4000000,
        "deadlineEpoch": 1793113200.0,
        "concurrency": 1,
        "retries": 0,
        "billing": "existing native subscriptions; no paid API fallback"
      },
      "dependencies": {
        "FalkorDB": "1.8.0",
        "Jinja2": "3.1.6",
        "MarkupSafe": "3.0.4",
        "PyJWT": "2.15.1",
        "PyYAML": "6.0.3",
        "Pygments": "2.21.0",
        "SQLAlchemy": "2.1.6",
        "StrEnum": "0.4.15",
        "aiohappyeyeballs": "2.7.1",
        "aiohttp": "3.14.5",
        "aiosignal": "1.4.0",
        "annotated-doc": "0.0.5",
        "annotated-types": "0.8.0",
        "anyio": "4.15.1",
        "attrs": "26.1.0",
        "backoff": "2.2.1",
        "boto3": "1.43.118",
        "botocore": "1.43.118",
        "certifi": "2026.10.23",
        "cffi": "2.1.1",
        "charset-normalizer": "3.5.2",
        "click": "8.5.0",
        "cryptography": "50.0.2",
        "deprecation": "2.1.0",
        "dirhash": "0.5.0",
        "distro": "1.9.0",
        "fastapi": "0.162.0",
        "fastembed": "0.9.1",
        "fastuuid": "0.14.0",
        "filelock": "3.32.7",
        "flatbuffers": "25.12.19",
        "frozenlist": "1.8.0",
        "fsspec": "2026.9.0",
        "graphiti-core": "0.31.2",
        "grpcio": "1.84.1",
        "h11": "0.16.0",
        "h2": "4.4.1",
        "harbor": "0.22.0",
        "hf-xet": "1.7.0",
        "hpack": "4.2.0",
        "httpcore": "1.0.9",
        "httpx": "0.28.1",
        "huggingface_hub": "1.33.0",
        "hyperframe": "6.1.0",
        "idna": "3.20",
        "importlib_metadata": "8.9.0",
        "jiter": "0.18.0",
        "jmespath": "1.1.0",
        "jsonschema": "4.26.0",
        "jsonschema-specifications": "2025.9.1",
        "litellm": "1.106.3",
        "loguru": "0.7.3",
        "markdown-it-py": "4.2.0",
        "mdurl": "0.1.2",
        "mem0ai": "2.2.1",
        "mmh3": "5.3.1",
        "multidict": "7.2.1",
        "neo4j": "6.4.1",
        "numpy": "2.5.4",
        "onnxruntime": "1.31.0",
        "openai": "2.54.0",
        "opentelemetry-api": "1.45.1",
        "packaging": "26.3",
        "pathspec": "1.1.1",
        "pillow": "13.0.0",
        "platformdirs": "4.13.5",
        "portalocker": "4.4.1",
        "postgrest": "2.33.0",
        "posthog": "7.75.11",
        "propcache": "0.5.4",
        "protobuf": "6.33.6",
        "py_rust_stemmers": "0.1.8",
        "pycparser": "3.12",
        "pydantic": "2.14.1",
        "pydantic-settings": "2.16.1",
        "pydantic_core": "2.50.1",
        "python-dateutil": "2.9.0.post0",
        "python-dotenv": "1.2.4",
        "pytz": "2026.5",
        "qdrant-client": "1.20.0",
        "realtime": "2.33.0",
        "redis": "8.1.0",
        "referencing": "0.37.0",
        "regex": "2026.9.29",
        "requests": "2.34.2",
        "rich": "15.0.0",
        "rpds-py": "2026.9.1",
        "s3transfer": "0.19.3",
        "scantree": "0.0.4",
        "shellingham": "1.5.4",
        "shortuuid": "1.0.13",
        "six": "1.17.0",
        "sniffio": "1.3.1",
        "starlette": "1.10.0",
        "storage3": "2.33.0",
        "supabase": "2.33.0",
        "supabase-auth": "2.33.0",
        "supabase-functions": "2.33.0",
        "tenacity": "9.2.1",
        "tiktoken": "0.14.0",
        "tokenizers": "0.23.3",
        "toml": "0.10.2",
        "tqdm": "4.70.1",
        "typer": "0.27.3",
        "typing-inspection": "0.4.4",
        "typing_extensions": "4.16.0",
        "urllib3": "2.8.0",
        "uvicorn": "0.54.0",
        "websockets": "15.0.1",
        "yarl": "1.25.1",
        "zipp": "4.1.2"
      },
      "id": "pilot-03",
      "terminal": true,
      "originalProtocolFileSha256": "8d22922f947f7f30306afa57da520a6ea6c8dd67d2cd11022d2376cd8991801a",
      "projectionNote": "Private absolute paths omitted; protocolHash identifies the retained original protocol, not this sanitized projection.",
      "actors": {
        "codex": {
          "model": "gpt-6.1-sol",
          "binarySha256": "d8990e3ee7acfbc26f91265b12a1a83f0fee40d0e0f8f1f40a37d4ec21f499cf",
          "version": "codex-cli 0.164.0",
          "modelIdentity": "requested-only",
          "runtimeFiles": [
            {
              "role": "code-mode-host",
              "sha256": "416721e33af8822041dc650793512b3e58d43e0be4f3a5c6187eb4dfaad3148a"
            }
          ]
        },
        "claude": {
          "model": "claude-sonnet-4-6",
          "binarySha256": "ffb64331bc0ee1b69efb7c2c428bd3ab516bc31b75bf60886b356c97c1c25ffd",
          "version": "2.1.310 (Claude Code)",
          "modelIdentity": "observed",
          "runtimeFiles": []
        }
      },
      "plannedTrajectories": 24,
      "recordedTrajectories": 9,
      "plannedSessionSlots": 48,
      "knownCodingTokens": 4046118,
      "unknownCodingUsage": 0,
      "recordedCodingSessions": 17,
      "actorElapsedMs": 1928244,
      "startedAt": 1793054148.501065,
      "finishedAt": 1793056158.251105,
      "dispatchStopped": {
        "all": "Frozen deadline or observed-token dispatch threshold reached"
      },
      "phaseWallSeconds": 2009.7500400543213
    },
    {
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "createdAt": "2026-10-26T19:24:43.816862-07:00",
      "sourceCommit": "5d3a58b7811808f9ef517623324a599cf47a8973",
      "sourceHashes": {
        "scripts/harbor/container_command.py": "72c65617f5678aa23ad5e1ca59730fb5b1be18034e6d74981a69ae0560b5699c",
        "scripts/harbor/container_tools.py": "d2454821acc7793fe5082a8a1b06b2f6281ec5b707a2ee890011407a012b46e6",
        "scripts/harbor/cost_delta.py": "3cf7b735b0fd1799a7b6f338638c61e0a8b756df73d7136bc6a8a731c0c6ddac",
        "scripts/harbor/diagnose_container.py": "ce068e533594fe4d1105ceb1a44a94e5fe61162501b0cc8a6c0a437db5a6eafc",
        "scripts/harbor/mcp_container_shell.py": "6452659c91a523053a7e19ae8e893ee89acf60d169147d7c3d7adcf05912b44a",
        "scripts/harbor/mcp_owned_container.py": "55253e6aefb38104f685ed4f86f319bb9b049a80f4b302f4c40f8c367f275c79",
        "scripts/harbor/memory_study/__init__.py": "1fcc4f3c58e6d23032beee7cd2180540a765632051a41d2ea28302eb06bd1d61",
        "scripts/harbor/memory_study/__main__.py": "47397f23e5a5b29cc41b20dd562cc58f09af4c96e370c811a9c8eb78ff94ca8f",
        "scripts/harbor/memory_study/agent.py": "c5cd2145e253db94a272385cc4c907d4647705e58f8d3fb6990ce469dead9f85",
        "scripts/harbor/memory_study/analysis.py": "145390e8eb8bac8d46769be7da655b238b2893bbe8c85053812559898dfc3f71",
        "scripts/harbor/memory_study/budget.py": "edb5aefa4d5564acf4a5183d063c66209629851752b73cd706959dffeb55064a",
        "scripts/harbor/memory_study/cleanup.py": "771138a5775ab6d9f352f36880f8d70a338d157961155190c6951b64141a5dc5",
        "scripts/harbor/memory_study/codex_subscription.py": "50814e8008c8b772cb2ec3921175ce0ef4582ff30473f92f4f3523dc73323e29",
        "scripts/harbor/memory_study/harness.py": "89cd79a1f412adde8d5691e249b4d8a235576dd69c4162a703e753cb7a754309",
        "scripts/harbor/memory_study/native_controls.py": "ae8d447a986357d83f39791b614ae5e692fd5d7910dccd49237963d3b267aaa2",
        "scripts/harbor/memory_study/prepare.py": "f06c33f70044b6021652dffd90178636f90170316f7bf11c7de269e4cb54c531",
        "scripts/harbor/memory_study/protocol.py": "9d3e3a60344f90b6228a44bab783ec8262011a7bb87116f2a5740fb97f91d452",
        "scripts/harbor/memory_study/providers.py": "86d386ffe9be82eb3ca77cf84a383f5d55b1dea706dd3d1a870f9db01f657e0b",
        "scripts/harbor/memory_study/qualification.py": "51077c97bfaccb9f12f7b105846b1ede98fa70f7b5e13269dafeb46444df975d",
        "scripts/harbor/memory_study/sdk_controls.py": "d997f4b6f2a97034a2619ad2f8369c1e7a96e1b8595fb5f9ad04d7c9a937ead9",
        "scripts/harbor/memory_study/subscription.py": "96faf2029f4f5c8d42da20ee075221e93fc64917a7db794d5eea8e191ef76d02",
        "scripts/harbor/memory_study/test_study.py": "d5c2138612bf0df7358435749283fa070bc8f151207546c57b86892ae38a306b",
        "scripts/harbor/memory_study/test_subscription.py": "7ec1f375c98c83e13972bb9cfd7dd44705122c635c2211498f8955de0c6c099e",
        "scripts/harbor/memory_study/usage.py": "a14997afba9521d93db78ad2976e6389afc0edebd1469b71d0833ea88616fcc8",
        "scripts/harbor/provenance.py": "d3e35635753e8d1fcebc817e268ffc3c3786c3851fa530305db7c6896e5cfc9b",
        "scripts/harbor/rm-batch-task/tests/test_outputs.py": "746d98ebaad8c622bc93e584843dfe2594db5ae0a357386fafb26f93159bc2b8",
        "scripts/harbor/rm-container-task/tests/test_outputs.py": "693dbacadce5d164ab6c2d93f5d32b416fb438652a152705744d30ee0f9aeedc",
        "scripts/harbor/rm-locality-task/environment/workspace/packages/shared/defaults.py": "cd86a842f705a1b676b83e51033229401280615e213abe9d864f923c2fb117d7",
        "scripts/harbor/rm-locality-task/environment/workspace/services/ingest/loader.py": "f147fd8738510495077588a188c08720b818e8598256cc05869cdf18f18d21c3",
        "scripts/harbor/rm-locality-task/tests/test_outputs.py": "f6b0e96da6541a54558c66d51d6f5fc94bcb63cc70bd8af472a106b73b581cef",
        "scripts/harbor/rm-migrations-task/tests/test_outputs.py": "7efa6b6c82855fd55afa2b1f413ecccf7815a9e0c886507621d41edf05ca9847",
        "scripts/harbor/rm-pagination-task/environment/store.py": "8ebc0595a6dd280fc9f64a67fe4685bd2017ddd9e95024f2e0c57fec66d55df2",
        "scripts/harbor/rm-pagination-task/tests/test_outputs.py": "ebf17e883f54b0998665d85f80719a0ded6dd9365ccfd2d9be47837387514a13",
        "scripts/harbor/rm-proto-task/tests/test_outputs.py": "535b19ec03aa5d7b457d8594f1fa556ed9b19937aedc56dc4e2fa2cb5454b249",
        "scripts/harbor/rm-recovery-task/environment/recover.py": "724bb8108cd28c7bdbc4727f0c71a4ebe76591954594689929db40c8e84546a9",
        "scripts/harbor/rm-recovery-task/solution/recover.py": "5ba7b97a75118155f59bd435cc99356cc1c382221217654be08eb8841c332c66",
        "scripts/harbor/rm-recovery-task/tests/test_outputs.py": "4edc13bbc2657c994406e80f9827fd610484a67929a2ef1369fc14152802268e",
        "scripts/harbor/rm_host_claude.py": "96d8a60b0114f6321f6f68d87cc8cb4e8e96f0c37302de4848ef75ac6c364b27",
        "scripts/harbor/rm_host_codex.py": "f44aa88c14dfe651d3e8caea131c49f0cea2ebbc53ea2d5b134ccdd67da03a00",
        "scripts/harbor/rm_host_container.py": "1a3c2c6edeb191109c101ad74f94ba990d5d995ea39a0ea3e516f0624cd35380",
        "scripts/harbor/rm_host_pi.py": "2738ae8655af0eca0871c41b54f35023b8b832535c3d5afab792f3830c48cd19",
        "scripts/harbor/rm_native_codex.py": "af7b37c7420b2f33d18d5df74bfca576c5a1c3fe58948582169f9d5b35b9a002",
        "scripts/harbor/summarize.py": "6d0f8dc291e9e49b201a560e34e36f5c43d3bff6ec66d52082b006f3fddd1b39",
        "scripts/harbor/test_full_parity_codex_config.py": "bcd51896601a1da8aaee406bc63eafc29f3a64e7b32268986463ab89a5217d11",
        "scripts/harbor/test_full_parity_pi.py": "1d95c4548060db9c590abadfe14f0b39b13c453d61cb14c856d54f0617d3221a",
        "scripts/harbor/test_native_codex.py": "05bd883ab88d2f6fbdcb2c17a935bcc34294fa3604fea03934bbf3a699be9c0c",
        "scripts/harbor/verdict_bridge.py": "999ccd8c382d69a3c1bc9ae435cca6e5e498ab98dfea601d37636563bb2119c6",
        "scripts/studies/supabase_rls/__init__.py": "ed3b61a97c9741f9862614bc18c8b634239b0f18b31b02820985432c488afe55",
        "scripts/studies/supabase_rls/database.py": "4841c172a28a56f203d54b989af054c0efd629c43988ad30372d96df754ea7f7",
        "scripts/studies/supabase_rls/fixtures.py": "13e04472c6fffbaa0712a6eaa625845d690c453d274050c29c9111a0e27f148a",
        "scripts/studies/supabase_rls/grader.py": "94cafe8ad11a88750f521b5cdb3a6bc66d58e2505490be4e5410bde75bc2c98a",
        "scripts/studies/supabase_rls/runner.py": "c9fbb0503c9309b16efb19cbb7bda3bd1f4f22ade4816d1611c43fff5dbec38f",
        "scripts/studies/supabase_rls/test_study.py": "2028138bd13e82f5cf8d9ab9f72d107e5cdaa3564a10f43736f6a372ebb93a5a"
      },
      "skillCommit": "c9be0e931b7930f7d02126d04774d904c381e7d7",
      "skillHashes": {
        "CHANGELOG.md": "751ad110037c85d400018c9894716a04fa46357ff55c22b1169b280752e19e88",
        "SKILL.md": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
        "references/_contributing.md": "191e039e7d94764e6073410b513b559f9a594e0fdf0252a30c2a2986df2ab3bc",
        "references/_sections.md": "c9e992612b422c7122de0b7542ebc2450db283edaab08cfe86c6d657fcccccd5",
        "references/_template.md": "6299954250f212caabe339d752c3e5313a8e07d1a182a4e4b425baee91df1bd2",
        "references/advanced-full-text-search.md": "40c2606bbb4c4dce31308f201b24cc7f58c7df05b1d9c6856fe2b888d3b7cf28",
        "references/advanced-jsonb-indexing.md": "24cacf6a8bc35901dd566d24502ce8e57f810a5c196b897e61d52726e521d106",
        "references/conn-idle-timeout.md": "630588902c00fcec59a5988cc5d042f76dcf2c923a535abfd8c47dca205eaed5",
        "references/conn-limits.md": "11b2a67a7c7679cbbc5d807bbb17e69c98484a581d0c8b929c03408f412b81b2",
        "references/conn-pooling.md": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
        "references/conn-prepared-statements.md": "174e9332fe3dda5c99b2b00159fb1915ae36c00bab3a7882c14e73e4344e946e",
        "references/data-batch-inserts.md": "531933b82d6a622d0fae29e0ea80be6fe5d78655adf2804c271ea84a1930de37",
        "references/data-n-plus-one.md": "21a44905e5b16a42741892ec34bb1bfef124d049b140a76934a9acd0f46f5fc2",
        "references/data-pagination.md": "73c9fa10a3d439bedea0e11b640bd25bf30dd50f0d9006cf85baf7c3151543fa",
        "references/data-upsert.md": "2612af83b20a2701dde30ef1f8d7efd26b7e9eef84717226b8f038a2d2150ff7",
        "references/lock-advisory.md": "c88d259dbf81c3771438f59a165f7eab8acd09999dd370bdf807521c73f35aab",
        "references/lock-deadlock-prevention.md": "09aee46f51d7178c8e55fe056cd5a94a64ba2c122fe418e6900cd99f297b2347",
        "references/lock-short-transactions.md": "5aa7f61095916986d39644b446cdbcd2bacca7ef698a3bb50b3f82dd60207602",
        "references/lock-skip-locked.md": "6c45077f430f29cd9cd8f448c94d578e827e7bd023fcdaf717a756acb116fa4b",
        "references/monitor-explain-analyze.md": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
        "references/monitor-pg-stat-statements.md": "89dca99d4e894fcbdcac136be7ad9fbc03d1342904f065c1b198dc9cf495f098",
        "references/monitor-vacuum-analyze.md": "2892272011710eb49b3f185ec12f15ce9ce4c365792c672f6e2a9c90da426a1a",
        "references/query-composite-indexes.md": "73e42424e671f0266e74fdb220db3196790f69fb43e2b19c7b9483eb4971b554",
        "references/query-covering-indexes.md": "daf2a7f0477fb7357b62b5fb5b185b1995a77a186347e45cb780e25e7a7589b6",
        "references/query-index-types.md": "472a74f22c2df203bd0154999b3a5a0187cca2ab3d9a3978e305bb7c32f1a282",
        "references/query-missing-indexes.md": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
        "references/query-partial-indexes.md": "6448982bc8558c6555284958edc331b29239c6a0130e6b4501dd6d4da607a6dd",
        "references/schema-constraints.md": "90e8efda3e9e81095e642911ad4aae2809d160f29414338fa997253238f510f8",
        "references/schema-data-types.md": "e01b58c14c7f3f65d8ead580b9a4fcf70b83baaab0f9a5f83c569c9fd113e8c8",
        "references/schema-foreign-key-indexes.md": "7587713d12a65a212365459b3d39e4717d8a79e4073b10bd62f1054d8192c0dd",
        "references/schema-lowercase-identifiers.md": "4bc80f70865f2390872591f326c8a6be6456a0aeb5a7e5a2475d7cd9d43059ab",
        "references/schema-partitioning.md": "541e13fbeaf4bb1485c9059d4c9417dbdb766cf16f4237cd63a04ada7ec45b90",
        "references/schema-primary-keys.md": "3c8beabef82066f9a0838b926da0885117fd2d9a263aaf84cb5ca9e5f0d400e9",
        "references/security-privileges.md": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
        "references/security-rls-basics.md": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
        "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014"
      },
      "docsHashes": {
        "postgres-17-rls.html": "4a192371e7ca0227a41ed822a46b6b25cee7cb43ece298b291264452481c9ee2",
        "supabase-rls.md": "b0b81f8b7f72e8fbd9e83314b9e4d1b658827754bfe9d469e0ec3a243a0029c0"
      },
      "schemaSha256": "f208daf6b08ca4a6d80a69abb983f062ad4a68c22a0d3e025ef51e58fbbd50d6",
      "promptHashes": {
        "tenant-records/1/baseline": "29c14bf96614bc48efc8e4ad93cb553eeeff1f03cbd4a14da9753783b9f3e305",
        "tenant-records/1/skill": "0e5521c05e2fb24a325715dad6800a519f289f6b2b6b222bc4db77e0f9d3e8c2",
        "tenant-records/2/baseline": "2bb3029150baa9ababc3cbf68859c59eac2cac9849c6f2ecd8c4ec914700aaea",
        "tenant-records/2/skill": "2bd1eb603eeadb8bf0c7cc6ed97cf975230f7fc764a959b7a8a2c06ffebcaceb",
        "document-sharing/1/baseline": "4a896d4196697757ec47d14c278b79b9f46508e9ef8768ca630ff372c2141dab",
        "document-sharing/1/skill": "589ffd6f7bcfa19fb449572fc19a16faf67abd048d5464d69c47e4674811abcf",
        "document-sharing/2/baseline": "398e5ba7a948e5616e9fb69664b045c6c512115f3cb1e273554abd492dd94b57",
        "document-sharing/2/skill": "0503680d6ffd39b9aab2e6c27d992e2a2170f2bea6a5014e1d064a215fe55db5",
        "public-catalog/1/baseline": "6ec799e9a9ae5937b9dff22f4074aedb379d73a1a5fd6c52f896fa293b08fc85",
        "public-catalog/1/skill": "5a8d24197fc347c34dcaac4cdb5e728c8826ab84d3a2c1ccf15f9219234d16ba",
        "public-catalog/2/baseline": "00f7283b91509cbe46deba9f9fa21c9aaefede05ac4a1ec640916a45569bf38a",
        "public-catalog/2/skill": "5df4f86c12cb792120abd7f59dbc9fa1b465c081b5b804c6769d3ad6b6c15fdc"
      },
      "imageReference": "public.ecr.aws/supabase/postgres@sha256:82a04ba6c05f60950a74ae46be3726abb18d06ee44da936276fd782e72e36855",
      "imageId": "sha256:d7eb0927f0a64ee80e11debd191c133dbb077da9ce7b0b7ca6bac660ba51b5ca",
      "budgets": {
        "plannedCodingSessions": 31,
        "qualificationSessions": 4,
        "secondsPerSession": null,
        "maxTurnsClaude": null,
        "maxContainerCommands": null,
        "maxObservedTokens": null,
        "deadlineEpoch": null,
        "concurrency": 1,
        "retries": 0,
        "billing": "existing native subscriptions; no paid API fallback",
        "executionPolicy": "uncapped"
      },
      "dependencies": {
        "FalkorDB": "1.8.0",
        "Jinja2": "3.1.6",
        "MarkupSafe": "3.0.4",
        "PyJWT": "2.15.1",
        "PyYAML": "6.0.3",
        "Pygments": "2.21.0",
        "SQLAlchemy": "2.1.6",
        "StrEnum": "0.4.15",
        "aiohappyeyeballs": "2.7.1",
        "aiohttp": "3.14.5",
        "aiosignal": "1.4.0",
        "annotated-doc": "0.0.5",
        "annotated-types": "0.8.0",
        "anyio": "4.15.1",
        "attrs": "26.1.0",
        "backoff": "2.2.1",
        "boto3": "1.43.118",
        "botocore": "1.43.118",
        "certifi": "2026.10.23",
        "cffi": "2.1.1",
        "charset-normalizer": "3.5.2",
        "click": "8.5.0",
        "cryptography": "50.0.2",
        "deprecation": "2.1.0",
        "dirhash": "0.5.0",
        "distro": "1.9.0",
        "fastapi": "0.162.0",
        "fastembed": "0.9.1",
        "fastuuid": "0.14.0",
        "filelock": "3.32.7",
        "flatbuffers": "25.12.19",
        "frozenlist": "1.8.0",
        "fsspec": "2026.9.0",
        "graphiti-core": "0.31.2",
        "grpcio": "1.84.1",
        "h11": "0.16.0",
        "h2": "4.4.1",
        "harbor": "0.22.0",
        "hf-xet": "1.7.0",
        "hpack": "4.2.0",
        "httpcore": "1.0.9",
        "httpx": "0.28.1",
        "huggingface_hub": "1.33.0",
        "hyperframe": "6.1.0",
        "idna": "3.20",
        "importlib_metadata": "8.9.0",
        "jiter": "0.18.0",
        "jmespath": "1.1.0",
        "jsonschema": "4.26.0",
        "jsonschema-specifications": "2025.9.1",
        "litellm": "1.106.3",
        "loguru": "0.7.3",
        "markdown-it-py": "4.2.0",
        "mdurl": "0.1.2",
        "mem0ai": "2.2.1",
        "mmh3": "5.3.1",
        "multidict": "7.2.1",
        "neo4j": "6.4.1",
        "numpy": "2.5.4",
        "onnxruntime": "1.31.0",
        "openai": "2.54.0",
        "opentelemetry-api": "1.45.1",
        "packaging": "26.3",
        "pathspec": "1.1.1",
        "pillow": "13.0.0",
        "platformdirs": "4.13.5",
        "portalocker": "4.4.1",
        "postgrest": "2.33.0",
        "posthog": "7.75.11",
        "propcache": "0.5.4",
        "protobuf": "6.33.6",
        "py_rust_stemmers": "0.1.8",
        "pycparser": "3.12",
        "pydantic": "2.14.1",
        "pydantic-settings": "2.16.1",
        "pydantic_core": "2.50.1",
        "python-dateutil": "2.9.0.post0",
        "python-dotenv": "1.2.4",
        "pytz": "2026.5",
        "qdrant-client": "1.20.0",
        "realtime": "2.33.0",
        "redis": "8.1.0",
        "referencing": "0.37.0",
        "regex": "2026.9.29",
        "requests": "2.34.2",
        "rich": "15.0.0",
        "rpds-py": "2026.9.1",
        "s3transfer": "0.19.3",
        "scantree": "0.0.4",
        "shellingham": "1.5.4",
        "shortuuid": "1.0.13",
        "six": "1.17.0",
        "sniffio": "1.3.1",
        "starlette": "1.10.0",
        "storage3": "2.33.0",
        "supabase": "2.33.0",
        "supabase-auth": "2.33.0",
        "supabase-functions": "2.33.0",
        "tenacity": "9.2.1",
        "tiktoken": "0.14.0",
        "tokenizers": "0.23.3",
        "toml": "0.10.2",
        "tqdm": "4.70.1",
        "typer": "0.27.3",
        "typing-inspection": "0.4.4",
        "typing_extensions": "4.16.0",
        "urllib3": "2.8.0",
        "uvicorn": "0.54.0",
        "websockets": "15.0.1",
        "yarl": "1.25.1",
        "zipp": "4.1.2"
      },
      "id": "continuation-uncapped-01",
      "terminal": true,
      "originalProtocolFileSha256": "a0a2945b87c6ab4da9f50fa62bfd3b71c3e0d55eb252b8819e2c025f142dec40",
      "projectionNote": "Private absolute paths omitted; protocolHash identifies the retained original protocol, not this sanitized projection.",
      "actors": {
        "codex": {
          "model": "gpt-6.1-sol",
          "binarySha256": "d8990e3ee7acfbc26f91265b12a1a83f0fee40d0e0f8f1f40a37d4ec21f499cf",
          "version": "codex-cli 0.164.0",
          "modelIdentity": "requested-only",
          "runtimeFiles": [
            {
              "role": "code-mode-host",
              "sha256": "416721e33af8822041dc650793512b3e58d43e0be4f3a5c6187eb4dfaad3148a"
            }
          ]
        },
        "claude": {
          "model": "claude-sonnet-4-6",
          "binarySha256": "ffb64331bc0ee1b69efb7c2c428bd3ab516bc31b75bf60886b356c97c1c25ffd",
          "version": "2.1.310 (Claude Code)",
          "modelIdentity": "observed",
          "runtimeFiles": []
        }
      },
      "plannedTrajectories": 16,
      "recordedTrajectories": 16,
      "plannedSessionSlots": 31,
      "knownCodingTokens": 4621211,
      "unknownCodingUsage": 0,
      "recordedCodingSessions": 31,
      "actorElapsedMs": 2737427,
      "startedAt": 1793068100.048948,
      "finishedAt": 1793071051.655235,
      "dispatchStopped": {},
      "phaseWallSeconds": 2951.6062870025635
    },
    {
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "createdAt": "2026-10-26T19:57:33.329292-07:00",
      "sourceCommit": "d28e771b925c1d17dedf817bb70ef82e973f3e50",
      "sourceHashes": {
        "scripts/harbor/container_command.py": "72c65617f5678aa23ad5e1ca59730fb5b1be18034e6d74981a69ae0560b5699c",
        "scripts/harbor/container_tools.py": "d2454821acc7793fe5082a8a1b06b2f6281ec5b707a2ee890011407a012b46e6",
        "scripts/harbor/cost_delta.py": "3cf7b735b0fd1799a7b6f338638c61e0a8b756df73d7136bc6a8a731c0c6ddac",
        "scripts/harbor/diagnose_container.py": "ce068e533594fe4d1105ceb1a44a94e5fe61162501b0cc8a6c0a437db5a6eafc",
        "scripts/harbor/mcp_container_shell.py": "6452659c91a523053a7e19ae8e893ee89acf60d169147d7c3d7adcf05912b44a",
        "scripts/harbor/mcp_owned_container.py": "55253e6aefb38104f685ed4f86f319bb9b049a80f4b302f4c40f8c367f275c79",
        "scripts/harbor/memory_study/__init__.py": "1fcc4f3c58e6d23032beee7cd2180540a765632051a41d2ea28302eb06bd1d61",
        "scripts/harbor/memory_study/__main__.py": "47397f23e5a5b29cc41b20dd562cc58f09af4c96e370c811a9c8eb78ff94ca8f",
        "scripts/harbor/memory_study/agent.py": "c5cd2145e253db94a272385cc4c907d4647705e58f8d3fb6990ce469dead9f85",
        "scripts/harbor/memory_study/analysis.py": "145390e8eb8bac8d46769be7da655b238b2893bbe8c85053812559898dfc3f71",
        "scripts/harbor/memory_study/budget.py": "edb5aefa4d5564acf4a5183d063c66209629851752b73cd706959dffeb55064a",
        "scripts/harbor/memory_study/cleanup.py": "771138a5775ab6d9f352f36880f8d70a338d157961155190c6951b64141a5dc5",
        "scripts/harbor/memory_study/codex_subscription.py": "50814e8008c8b772cb2ec3921175ce0ef4582ff30473f92f4f3523dc73323e29",
        "scripts/harbor/memory_study/harness.py": "89cd79a1f412adde8d5691e249b4d8a235576dd69c4162a703e753cb7a754309",
        "scripts/harbor/memory_study/native_controls.py": "ae8d447a986357d83f39791b614ae5e692fd5d7910dccd49237963d3b267aaa2",
        "scripts/harbor/memory_study/prepare.py": "f06c33f70044b6021652dffd90178636f90170316f7bf11c7de269e4cb54c531",
        "scripts/harbor/memory_study/protocol.py": "9d3e3a60344f90b6228a44bab783ec8262011a7bb87116f2a5740fb97f91d452",
        "scripts/harbor/memory_study/providers.py": "86d386ffe9be82eb3ca77cf84a383f5d55b1dea706dd3d1a870f9db01f657e0b",
        "scripts/harbor/memory_study/qualification.py": "51077c97bfaccb9f12f7b105846b1ede98fa70f7b5e13269dafeb46444df975d",
        "scripts/harbor/memory_study/sdk_controls.py": "d997f4b6f2a97034a2619ad2f8369c1e7a96e1b8595fb5f9ad04d7c9a937ead9",
        "scripts/harbor/memory_study/subscription.py": "96faf2029f4f5c8d42da20ee075221e93fc64917a7db794d5eea8e191ef76d02",
        "scripts/harbor/memory_study/test_study.py": "d5c2138612bf0df7358435749283fa070bc8f151207546c57b86892ae38a306b",
        "scripts/harbor/memory_study/test_subscription.py": "7ec1f375c98c83e13972bb9cfd7dd44705122c635c2211498f8955de0c6c099e",
        "scripts/harbor/memory_study/usage.py": "a14997afba9521d93db78ad2976e6389afc0edebd1469b71d0833ea88616fcc8",
        "scripts/harbor/provenance.py": "d3e35635753e8d1fcebc817e268ffc3c3786c3851fa530305db7c6896e5cfc9b",
        "scripts/harbor/rm-batch-task/tests/test_outputs.py": "746d98ebaad8c622bc93e584843dfe2594db5ae0a357386fafb26f93159bc2b8",
        "scripts/harbor/rm-container-task/tests/test_outputs.py": "693dbacadce5d164ab6c2d93f5d32b416fb438652a152705744d30ee0f9aeedc",
        "scripts/harbor/rm-locality-task/environment/workspace/packages/shared/defaults.py": "cd86a842f705a1b676b83e51033229401280615e213abe9d864f923c2fb117d7",
        "scripts/harbor/rm-locality-task/environment/workspace/services/ingest/loader.py": "f147fd8738510495077588a188c08720b818e8598256cc05869cdf18f18d21c3",
        "scripts/harbor/rm-locality-task/tests/test_outputs.py": "f6b0e96da6541a54558c66d51d6f5fc94bcb63cc70bd8af472a106b73b581cef",
        "scripts/harbor/rm-migrations-task/tests/test_outputs.py": "7efa6b6c82855fd55afa2b1f413ecccf7815a9e0c886507621d41edf05ca9847",
        "scripts/harbor/rm-pagination-task/environment/store.py": "8ebc0595a6dd280fc9f64a67fe4685bd2017ddd9e95024f2e0c57fec66d55df2",
        "scripts/harbor/rm-pagination-task/tests/test_outputs.py": "ebf17e883f54b0998665d85f80719a0ded6dd9365ccfd2d9be47837387514a13",
        "scripts/harbor/rm-proto-task/tests/test_outputs.py": "535b19ec03aa5d7b457d8594f1fa556ed9b19937aedc56dc4e2fa2cb5454b249",
        "scripts/harbor/rm-recovery-task/environment/recover.py": "724bb8108cd28c7bdbc4727f0c71a4ebe76591954594689929db40c8e84546a9",
        "scripts/harbor/rm-recovery-task/solution/recover.py": "5ba7b97a75118155f59bd435cc99356cc1c382221217654be08eb8841c332c66",
        "scripts/harbor/rm-recovery-task/tests/test_outputs.py": "4edc13bbc2657c994406e80f9827fd610484a67929a2ef1369fc14152802268e",
        "scripts/harbor/rm_host_claude.py": "96d8a60b0114f6321f6f68d87cc8cb4e8e96f0c37302de4848ef75ac6c364b27",
        "scripts/harbor/rm_host_codex.py": "f44aa88c14dfe651d3e8caea131c49f0cea2ebbc53ea2d5b134ccdd67da03a00",
        "scripts/harbor/rm_host_container.py": "1a3c2c6edeb191109c101ad74f94ba990d5d995ea39a0ea3e516f0624cd35380",
        "scripts/harbor/rm_host_pi.py": "2738ae8655af0eca0871c41b54f35023b8b832535c3d5afab792f3830c48cd19",
        "scripts/harbor/rm_native_codex.py": "af7b37c7420b2f33d18d5df74bfca576c5a1c3fe58948582169f9d5b35b9a002",
        "scripts/harbor/summarize.py": "6d0f8dc291e9e49b201a560e34e36f5c43d3bff6ec66d52082b006f3fddd1b39",
        "scripts/harbor/test_full_parity_codex_config.py": "bcd51896601a1da8aaee406bc63eafc29f3a64e7b32268986463ab89a5217d11",
        "scripts/harbor/test_full_parity_pi.py": "1d95c4548060db9c590abadfe14f0b39b13c453d61cb14c856d54f0617d3221a",
        "scripts/harbor/test_native_codex.py": "05bd883ab88d2f6fbdcb2c17a935bcc34294fa3604fea03934bbf3a699be9c0c",
        "scripts/harbor/verdict_bridge.py": "999ccd8c382d69a3c1bc9ae435cca6e5e498ab98dfea601d37636563bb2119c6",
        "scripts/studies/supabase_rls/__init__.py": "ed3b61a97c9741f9862614bc18c8b634239b0f18b31b02820985432c488afe55",
        "scripts/studies/supabase_rls/database.py": "4841c172a28a56f203d54b989af054c0efd629c43988ad30372d96df754ea7f7",
        "scripts/studies/supabase_rls/fixtures.py": "13e04472c6fffbaa0712a6eaa625845d690c453d274050c29c9111a0e27f148a",
        "scripts/studies/supabase_rls/grader.py": "94cafe8ad11a88750f521b5cdb3a6bc66d58e2505490be4e5410bde75bc2c98a",
        "scripts/studies/supabase_rls/runner.py": "c9fbb0503c9309b16efb19cbb7bda3bd1f4f22ade4816d1611c43fff5dbec38f",
        "scripts/studies/supabase_rls/test_study.py": "2028138bd13e82f5cf8d9ab9f72d107e5cdaa3564a10f43736f6a372ebb93a5a"
      },
      "skillCommit": "c9be0e931b7930f7d02126d04774d904c381e7d7",
      "skillHashes": {
        "CHANGELOG.md": "751ad110037c85d400018c9894716a04fa46357ff55c22b1169b280752e19e88",
        "SKILL.md": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
        "references/_contributing.md": "191e039e7d94764e6073410b513b559f9a594e0fdf0252a30c2a2986df2ab3bc",
        "references/_sections.md": "c9e992612b422c7122de0b7542ebc2450db283edaab08cfe86c6d657fcccccd5",
        "references/_template.md": "6299954250f212caabe339d752c3e5313a8e07d1a182a4e4b425baee91df1bd2",
        "references/advanced-full-text-search.md": "40c2606bbb4c4dce31308f201b24cc7f58c7df05b1d9c6856fe2b888d3b7cf28",
        "references/advanced-jsonb-indexing.md": "24cacf6a8bc35901dd566d24502ce8e57f810a5c196b897e61d52726e521d106",
        "references/conn-idle-timeout.md": "630588902c00fcec59a5988cc5d042f76dcf2c923a535abfd8c47dca205eaed5",
        "references/conn-limits.md": "11b2a67a7c7679cbbc5d807bbb17e69c98484a581d0c8b929c03408f412b81b2",
        "references/conn-pooling.md": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
        "references/conn-prepared-statements.md": "174e9332fe3dda5c99b2b00159fb1915ae36c00bab3a7882c14e73e4344e946e",
        "references/data-batch-inserts.md": "531933b82d6a622d0fae29e0ea80be6fe5d78655adf2804c271ea84a1930de37",
        "references/data-n-plus-one.md": "21a44905e5b16a42741892ec34bb1bfef124d049b140a76934a9acd0f46f5fc2",
        "references/data-pagination.md": "73c9fa10a3d439bedea0e11b640bd25bf30dd50f0d9006cf85baf7c3151543fa",
        "references/data-upsert.md": "2612af83b20a2701dde30ef1f8d7efd26b7e9eef84717226b8f038a2d2150ff7",
        "references/lock-advisory.md": "c88d259dbf81c3771438f59a165f7eab8acd09999dd370bdf807521c73f35aab",
        "references/lock-deadlock-prevention.md": "09aee46f51d7178c8e55fe056cd5a94a64ba2c122fe418e6900cd99f297b2347",
        "references/lock-short-transactions.md": "5aa7f61095916986d39644b446cdbcd2bacca7ef698a3bb50b3f82dd60207602",
        "references/lock-skip-locked.md": "6c45077f430f29cd9cd8f448c94d578e827e7bd023fcdaf717a756acb116fa4b",
        "references/monitor-explain-analyze.md": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
        "references/monitor-pg-stat-statements.md": "89dca99d4e894fcbdcac136be7ad9fbc03d1342904f065c1b198dc9cf495f098",
        "references/monitor-vacuum-analyze.md": "2892272011710eb49b3f185ec12f15ce9ce4c365792c672f6e2a9c90da426a1a",
        "references/query-composite-indexes.md": "73e42424e671f0266e74fdb220db3196790f69fb43e2b19c7b9483eb4971b554",
        "references/query-covering-indexes.md": "daf2a7f0477fb7357b62b5fb5b185b1995a77a186347e45cb780e25e7a7589b6",
        "references/query-index-types.md": "472a74f22c2df203bd0154999b3a5a0187cca2ab3d9a3978e305bb7c32f1a282",
        "references/query-missing-indexes.md": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
        "references/query-partial-indexes.md": "6448982bc8558c6555284958edc331b29239c6a0130e6b4501dd6d4da607a6dd",
        "references/schema-constraints.md": "90e8efda3e9e81095e642911ad4aae2809d160f29414338fa997253238f510f8",
        "references/schema-data-types.md": "e01b58c14c7f3f65d8ead580b9a4fcf70b83baaab0f9a5f83c569c9fd113e8c8",
        "references/schema-foreign-key-indexes.md": "7587713d12a65a212365459b3d39e4717d8a79e4073b10bd62f1054d8192c0dd",
        "references/schema-lowercase-identifiers.md": "4bc80f70865f2390872591f326c8a6be6456a0aeb5a7e5a2475d7cd9d43059ab",
        "references/schema-partitioning.md": "541e13fbeaf4bb1485c9059d4c9417dbdb766cf16f4237cd63a04ada7ec45b90",
        "references/schema-primary-keys.md": "3c8beabef82066f9a0838b926da0885117fd2d9a263aaf84cb5ca9e5f0d400e9",
        "references/security-privileges.md": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
        "references/security-rls-basics.md": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
        "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014"
      },
      "docsHashes": {
        "postgres-17-rls.html": "4a192371e7ca0227a41ed822a46b6b25cee7cb43ece298b291264452481c9ee2",
        "supabase-rls.md": "b0b81f8b7f72e8fbd9e83314b9e4d1b658827754bfe9d469e0ec3a243a0029c0"
      },
      "schemaSha256": "f208daf6b08ca4a6d80a69abb983f062ad4a68c22a0d3e025ef51e58fbbd50d6",
      "promptHashes": {
        "tenant-records/1/baseline": "29c14bf96614bc48efc8e4ad93cb553eeeff1f03cbd4a14da9753783b9f3e305",
        "tenant-records/1/skill": "0e5521c05e2fb24a325715dad6800a519f289f6b2b6b222bc4db77e0f9d3e8c2",
        "tenant-records/2/baseline": "2bb3029150baa9ababc3cbf68859c59eac2cac9849c6f2ecd8c4ec914700aaea",
        "tenant-records/2/skill": "2bd1eb603eeadb8bf0c7cc6ed97cf975230f7fc764a959b7a8a2c06ffebcaceb",
        "document-sharing/1/baseline": "4a896d4196697757ec47d14c278b79b9f46508e9ef8768ca630ff372c2141dab",
        "document-sharing/1/skill": "589ffd6f7bcfa19fb449572fc19a16faf67abd048d5464d69c47e4674811abcf",
        "document-sharing/2/baseline": "398e5ba7a948e5616e9fb69664b045c6c512115f3cb1e273554abd492dd94b57",
        "document-sharing/2/skill": "0503680d6ffd39b9aab2e6c27d992e2a2170f2bea6a5014e1d064a215fe55db5",
        "public-catalog/1/baseline": "6ec799e9a9ae5937b9dff22f4074aedb379d73a1a5fd6c52f896fa293b08fc85",
        "public-catalog/1/skill": "5a8d24197fc347c34dcaac4cdb5e728c8826ab84d3a2c1ccf15f9219234d16ba",
        "public-catalog/2/baseline": "00f7283b91509cbe46deba9f9fa21c9aaefede05ac4a1ec640916a45569bf38a",
        "public-catalog/2/skill": "5df4f86c12cb792120abd7f59dbc9fa1b465c081b5b804c6769d3ad6b6c15fdc"
      },
      "imageReference": "public.ecr.aws/supabase/postgres@sha256:82a04ba6c05f60950a74ae46be3726abb18d06ee44da936276fd782e72e36855",
      "imageId": "sha256:d7eb0927f0a64ee80e11debd191c133dbb077da9ce7b0b7ca6bac660ba51b5ca",
      "budgets": {
        "executionPolicy": "uncapped",
        "plannedCodingSessions": 48,
        "qualificationSessions": 4,
        "secondsPerSession": null,
        "maxTurnsClaude": null,
        "maxContainerCommands": null,
        "maxObservedTokens": null,
        "deadlineEpoch": null,
        "concurrency": 1,
        "retries": 0,
        "billing": "existing native subscriptions; no paid API fallback"
      },
      "dependencies": {
        "FalkorDB": "1.8.0",
        "Jinja2": "3.1.6",
        "MarkupSafe": "3.0.4",
        "PyJWT": "2.15.1",
        "PyYAML": "6.0.3",
        "Pygments": "2.21.0",
        "SQLAlchemy": "2.1.6",
        "StrEnum": "0.4.15",
        "aiohappyeyeballs": "2.7.1",
        "aiohttp": "3.14.5",
        "aiosignal": "1.4.0",
        "annotated-doc": "0.0.5",
        "annotated-types": "0.8.0",
        "anyio": "4.15.1",
        "attrs": "26.1.0",
        "backoff": "2.2.1",
        "boto3": "1.43.118",
        "botocore": "1.43.118",
        "certifi": "2026.10.23",
        "cffi": "2.1.1",
        "charset-normalizer": "3.5.2",
        "click": "8.5.0",
        "cryptography": "50.0.2",
        "deprecation": "2.1.0",
        "dirhash": "0.5.0",
        "distro": "1.9.0",
        "fastapi": "0.162.0",
        "fastembed": "0.9.1",
        "fastuuid": "0.14.0",
        "filelock": "3.32.7",
        "flatbuffers": "25.12.19",
        "frozenlist": "1.8.0",
        "fsspec": "2026.9.0",
        "graphiti-core": "0.31.2",
        "grpcio": "1.84.1",
        "h11": "0.16.0",
        "h2": "4.4.1",
        "harbor": "0.22.0",
        "hf-xet": "1.7.0",
        "hpack": "4.2.0",
        "httpcore": "1.0.9",
        "httpx": "0.28.1",
        "huggingface_hub": "1.33.0",
        "hyperframe": "6.1.0",
        "idna": "3.20",
        "importlib_metadata": "8.9.0",
        "jiter": "0.18.0",
        "jmespath": "1.1.0",
        "jsonschema": "4.26.0",
        "jsonschema-specifications": "2025.9.1",
        "litellm": "1.106.3",
        "loguru": "0.7.3",
        "markdown-it-py": "4.2.0",
        "mdurl": "0.1.2",
        "mem0ai": "2.2.1",
        "mmh3": "5.3.1",
        "multidict": "7.2.1",
        "neo4j": "6.4.1",
        "numpy": "2.5.4",
        "onnxruntime": "1.31.0",
        "openai": "2.54.0",
        "opentelemetry-api": "1.45.1",
        "packaging": "26.3",
        "pathspec": "1.1.1",
        "pillow": "13.0.0",
        "platformdirs": "4.13.5",
        "portalocker": "4.4.1",
        "postgrest": "2.33.0",
        "posthog": "7.75.11",
        "propcache": "0.5.4",
        "protobuf": "6.33.6",
        "py_rust_stemmers": "0.1.8",
        "pycparser": "3.12",
        "pydantic": "2.14.1",
        "pydantic-settings": "2.16.1",
        "pydantic_core": "2.50.1",
        "python-dateutil": "2.9.0.post0",
        "python-dotenv": "1.2.4",
        "pytz": "2026.5",
        "qdrant-client": "1.20.0",
        "realtime": "2.33.0",
        "redis": "8.1.0",
        "referencing": "0.37.0",
        "regex": "2026.9.29",
        "requests": "2.34.2",
        "rich": "15.0.0",
        "rpds-py": "2026.9.1",
        "s3transfer": "0.19.3",
        "scantree": "0.0.4",
        "shellingham": "1.5.4",
        "shortuuid": "1.0.13",
        "six": "1.17.0",
        "sniffio": "1.3.1",
        "starlette": "1.10.0",
        "storage3": "2.33.0",
        "supabase": "2.33.0",
        "supabase-auth": "2.33.0",
        "supabase-functions": "2.33.0",
        "tenacity": "9.2.1",
        "tiktoken": "0.14.0",
        "tokenizers": "0.23.3",
        "toml": "0.10.2",
        "tqdm": "4.70.1",
        "typer": "0.27.3",
        "typing-inspection": "0.4.4",
        "typing_extensions": "4.16.0",
        "urllib3": "2.8.0",
        "uvicorn": "0.54.0",
        "websockets": "15.0.1",
        "yarl": "1.25.1",
        "zipp": "4.1.2"
      },
      "id": "lower-models-01",
      "terminal": true,
      "originalProtocolFileSha256": "906dfc84fae19a247f7ed29fc891b04313a02b7d06128e95d18d2e7c8a0710eb",
      "projectionNote": "Private absolute paths omitted; protocolHash identifies the retained original protocol, not this sanitized projection.",
      "actors": {
        "codex": {
          "model": "gpt-6-luna",
          "binarySha256": "d8990e3ee7acfbc26f91265b12a1a83f0fee40d0e0f8f1f40a37d4ec21f499cf",
          "version": "codex-cli 0.164.0",
          "modelIdentity": "requested-only",
          "runtimeFiles": [
            {
              "role": "code-mode-host",
              "sha256": "416721e33af8822041dc650793512b3e58d43e0be4f3a5c6187eb4dfaad3148a"
            }
          ]
        },
        "claude": {
          "model": "claude-haiku-5-5",
          "binarySha256": "ffb64331bc0ee1b69efb7c2c428bd3ab516bc31b75bf60886b356c97c1c25ffd",
          "version": "2.1.310 (Claude Code)",
          "modelIdentity": "observed",
          "runtimeFiles": []
        }
      },
      "plannedTrajectories": 24,
      "recordedTrajectories": 24,
      "plannedSessionSlots": 48,
      "knownCodingTokens": 8671540,
      "unknownCodingUsage": 0,
      "recordedCodingSessions": 48,
      "actorElapsedMs": 2488747,
      "startedAt": 1793071063.263104,
      "finishedAt": 1793073951.385751,
      "dispatchStopped": {},
      "phaseWallSeconds": 2888.122647047043
    }
  ],
  "comparisons": [
    {
      "model": "claude-haiku-5-5",
      "harness": "claude",
      "phase": "lower-models-01",
      "policy": "uncapped",
      "matchedPairs": 6,
      "independentFamilies": 3,
      "pairIds": [
        "tenant-records-1",
        "tenant-records-2",
        "document-sharing-1",
        "document-sharing-2",
        "public-catalog-1",
        "public-catalog-2"
      ],
      "baseline": {
        "frozenStrictSuccesses": 6,
        "sensitivityStrictSuccesses": 6,
        "knownTokens": 2832850,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 887287,
        "sessions": 12
      },
      "skill": {
        "frozenStrictSuccesses": 6,
        "sensitivityStrictSuccesses": 6,
        "knownTokens": 2579138,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 863294,
        "sessions": 12
      }
    },
    {
      "model": "claude-sonnet-4-6",
      "harness": "claude",
      "phase": "continuation-uncapped-01",
      "policy": "uncapped",
      "matchedPairs": 3,
      "independentFamilies": 2,
      "pairIds": [
        "tenant-records-1",
        "tenant-records-2",
        "public-catalog-1"
      ],
      "baseline": {
        "frozenStrictSuccesses": 1,
        "sensitivityStrictSuccesses": 3,
        "knownTokens": 792351,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 616362,
        "sessions": 6
      },
      "skill": {
        "frozenStrictSuccesses": 1,
        "sensitivityStrictSuccesses": 3,
        "knownTokens": 1234167,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 967554,
        "sessions": 6
      }
    },
    {
      "model": "claude-sonnet-4-6",
      "harness": "claude",
      "phase": "pilot-03",
      "policy": "capped",
      "matchedPairs": 2,
      "independentFamilies": 2,
      "pairIds": [
        "document-sharing-1",
        "public-catalog-2"
      ],
      "baseline": {
        "frozenStrictSuccesses": 0,
        "sensitivityStrictSuccesses": 2,
        "knownTokens": 897953,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 570611,
        "sessions": 4
      },
      "skill": {
        "frozenStrictSuccesses": 1,
        "sensitivityStrictSuccesses": 2,
        "knownTokens": 1701004,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 798652,
        "sessions": 4
      }
    },
    {
      "model": "gpt-6-luna",
      "harness": "codex",
      "phase": "lower-models-01",
      "policy": "uncapped",
      "matchedPairs": 6,
      "independentFamilies": 3,
      "pairIds": [
        "tenant-records-1",
        "tenant-records-2",
        "document-sharing-1",
        "document-sharing-2",
        "public-catalog-1",
        "public-catalog-2"
      ],
      "baseline": {
        "frozenStrictSuccesses": 6,
        "sensitivityStrictSuccesses": 6,
        "knownTokens": 1495280,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 330824,
        "sessions": 12
      },
      "skill": {
        "frozenStrictSuccesses": 6,
        "sensitivityStrictSuccesses": 6,
        "knownTokens": 1764272,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 407342,
        "sessions": 12
      }
    },
    {
      "model": "gpt-6.1-sol",
      "harness": "codex",
      "phase": "continuation-uncapped-01",
      "policy": "uncapped",
      "matchedPairs": 4,
      "independentFamilies": 3,
      "pairIds": [
        "tenant-records-1",
        "tenant-records-2",
        "document-sharing-2",
        "public-catalog-1"
      ],
      "baseline": {
        "frozenStrictSuccesses": 4,
        "sensitivityStrictSuccesses": 4,
        "knownTokens": 947584,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 387103,
        "sessions": 8
      },
      "skill": {
        "frozenStrictSuccesses": 4,
        "sensitivityStrictSuccesses": 4,
        "knownTokens": 1130587,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 442223,
        "sessions": 8
      }
    },
    {
      "model": "gpt-6.1-sol",
      "harness": "codex",
      "phase": "pilot-03",
      "policy": "capped",
      "matchedPairs": 2,
      "independentFamilies": 2,
      "pairIds": [
        "document-sharing-1",
        "public-catalog-2"
      ],
      "baseline": {
        "frozenStrictSuccesses": 2,
        "sensitivityStrictSuccesses": 2,
        "knownTokens": 530962,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 184520,
        "sessions": 4
      },
      "skill": {
        "frozenStrictSuccesses": 2,
        "sensitivityStrictSuccesses": 2,
        "knownTokens": 600236,
        "unknownUsageSessions": 0,
        "actorElapsedMs": 177732,
        "sessions": 4
      }
    }
  ],
  "crossPolicyPairsExcludedFromComparisons": [
    {
      "model": "claude-sonnet-4-6",
      "task": "document-sharing",
      "repeat": 2,
      "reason": "arms span different execution policies",
      "baselinePhase": "continuation-uncapped-01",
      "baselinePolicy": "mixed capped\u2192uncapped",
      "skillPhase": "continuation-uncapped-01",
      "skillPolicy": "uncapped"
    }
  ],
  "trajectoryRecords": [
    {
      "phase": "pilot-03",
      "id": "public-catalog-2-claude-skill",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "capped",
      "resultSha256": "843d828c3c66c88afe3583e1da358f5446e126b905179d36f794e5c30ec77164",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 436454,
          "wholeTreeTokens": 436454,
          "usageComplete": true,
          "actorElapsedMs": 215262,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 19,
          "skillReadCommandObserved": true,
          "migrationSha256": "903aee26cedc50353c5c70e5a3195fd48d239a35f1f54e4144c41156f41c9b3a",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "580ef41d497391aa965daaabe72851da886c6ea55587185a810b876a4dcb26fa"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 178339,
          "wholeTreeTokens": 178339,
          "usageComplete": true,
          "actorElapsedMs": 67335,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 14,
          "skillReadCommandObserved": false,
          "migrationSha256": "98b19f4414676a27e9a8d2911ab4974f8b02d95005b4e5b45cc5a122427041b0",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "689cc10fff0ef19a826d4d97a0e990487fb948e48e2c9655621eae3c1d93076f",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "903aee26cedc50353c5c70e5a3195fd48d239a35f1f54e4144c41156f41c9b3a",
          "sql": "-- Enable RLS on tables exposed to clients\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares  ENABLE ROW LEVEL SECURITY;\n\n-- Revoke all existing grants from client roles on every table\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\nREVOKE ALL ON TABLE public.memberships   FROM anon, authenticated;\nREVOKE ALL ON TABLE public.records       FROM anon, authenticated;\nREVOKE ALL ON TABLE public.shares        FROM anon, authenticated;\n\n-- organizations: read-only (clients need org names; no writes allowed)\nGRANT SELECT ON TABLE public.organizations TO anon, authenticated;\n\n-- memberships: no direct client access; the security-definer helper reads it\n-- shares: no grants at all; deny before any policy can run\n\n-- records: all roles read; only authenticated gets write grants (policies restrict further)\nGRANT SELECT                    ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, UPDATE, DELETE    ON TABLE public.records TO authenticated;\n\n-- Private schema for internal helpers not callable over the Data API\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\n\n-- Returns true when the caller is an editor member of the given org.\n-- Runs as migrator (table owner) so it can read memberships without a client grant.\nCREATE OR REPLACE FUNCTION private.is_editor_of(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access  = 'editor'\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_editor_of(uuid) FROM PUBLIC;\nGRANT USAGE    ON SCHEMA private TO authenticated;\nGRANT EXECUTE  ON FUNCTION private.is_editor_of(uuid) TO authenticated;\n\n-- Returns true when the stored org_id and owner_id for p_id match the supplied values.\n-- Used in the UPDATE WITH CHECK to enforce immutability of those columns.\n-- Runs as migrator so it reads the existing row despite the caller's RLS context.\nCREATE OR REPLACE FUNCTION private.record_fields_unchanged(p_id integer, p_org_id uuid, p_owner_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records\n    WHERE id       = p_id\n      AND org_id   = p_org_id\n      AND owner_id = p_owner_id\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.record_fields_unchanged(integer, uuid, uuid) FROM PUBLIC;\nGRANT EXECUTE  ON FUNCTION private.record_fields_unchanged(integer, uuid, uuid) TO authenticated;\n\n-- Indexes so the policy subqueries hit index scans, not sequential scans\nCREATE INDEX IF NOT EXISTS memberships_user_id_idx\n  ON public.memberships USING btree (user_id);\n\nCREATE INDEX IF NOT EXISTS records_org_id_idx\n  ON public.records USING btree (org_id);\n\n-- \u2500\u2500 RLS policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Everyone (including anonymous) reads every record regardless of published\nCREATE POLICY \"records_select\"\n  ON public.records FOR SELECT\n  TO anon, authenticated\n  USING (true);\n\n-- Editors INSERT into their own org; owner_id must equal their identity\nCREATE POLICY \"records_insert\"\n  ON public.records FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    (SELECT private.is_editor_of(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\n-- Editors UPDATE their own org's records; org_id and owner_id must not change\nCREATE POLICY \"records_update\"\n  ON public.records FOR UPDATE\n  TO authenticated\n  USING  ((SELECT private.is_editor_of(org_id)))\n  WITH CHECK (\n    (SELECT private.is_editor_of(org_id))\n    AND (SELECT private.record_fields_unchanged(id, org_id, owner_id))\n  );\n\n-- Editors DELETE their own org's records\nCREATE POLICY \"records_delete\"\n  ON public.records FOR DELETE\n  TO authenticated\n  USING ((SELECT private.is_editor_of(org_id)));\n"
        },
        {
          "stage": 2,
          "sha256": "98b19f4414676a27e9a8d2911ab4974f8b02d95005b4e5b45cc5a122427041b0",
          "sql": "-- Unpublished records are now private drafts.\n-- Drop the original all-public SELECT policy and replace it with two\n-- draft-aware policies: one for anon (published only) and one for\n-- authenticated (published, or any record in the caller's own org if editor).\n\nDROP POLICY \"records_select\" ON public.records;\n\nCREATE POLICY \"records_select_anon\"\n  ON public.records FOR SELECT\n  TO anon\n  USING (published = true);\n\nCREATE POLICY \"records_select_authenticated\"\n  ON public.records FOR SELECT\n  TO authenticated\n  USING (\n    published = true\n    OR (SELECT private.is_editor_of(org_id))\n  );\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 614793,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 282597
    },
    {
      "phase": "pilot-03",
      "id": "public-catalog-2-claude-baseline",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "capped",
      "resultSha256": "e81fd8bf9ee97c862e4746e8f10d25dbf14a4241b33467b8a0f5463c09364b32",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 32,
          "totalChecks": 34
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 32,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_check_immutable() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 252535,
          "wholeTreeTokens": 252535,
          "usageComplete": true,
          "actorElapsedMs": 175351,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 12,
          "skillReadCommandObserved": false,
          "migrationSha256": "d6ca2e4bb0ace1095e437a7eaac2189bac9b347ffe80bc4fba1d365af6d3777f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "9d96fd10ae9adbcb16d3ce798123419ec21de865a9829cc81d9e9e45686f6ef4"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 59660,
          "wholeTreeTokens": 59660,
          "usageComplete": true,
          "actorElapsedMs": 52323,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "a5b425e4476d48202e6a84e0658f4b111ad2bebdea505f52e13c4b4c1cdb2de4",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "4be68c00ab1f66c0613cc2b3eba01d907af8dbe1249aca3eeadd5cf2feca63db",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "d6ca2e4bb0ace1095e437a7eaac2189bac9b347ffe80bc4fba1d365af6d3777f",
          "sql": "-- Enable RLS on every table so the deny-by-default gate is in place.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships   ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records       ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares        ENABLE ROW LEVEL SECURITY;\n\n-- Wipe any privileges clients might have inherited (safe no-op if none exist).\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\nREVOKE ALL ON TABLE public.memberships   FROM anon, authenticated;\nREVOKE ALL ON TABLE public.records       FROM anon, authenticated;\nREVOKE ALL ON TABLE public.shares        FROM anon, authenticated;\n\n-- records: everyone can read; only authenticated users can write.\nGRANT SELECT                    ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, UPDATE, DELETE    ON TABLE public.records TO authenticated;\n\n-- Index memberships.user_id so editor-check sub-queries don't scan the table.\nCREATE INDEX memberships_user_id_idx\n  ON public.memberships USING btree (user_id);\n\n-- Private schema: holds helper functions that must not be callable over the API.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM public;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Security-definer function so the records policies can read memberships\n-- without granting SELECT on memberships to client roles.\n-- Runs as migrator (table owner) \u2192 bypasses RLS on memberships.\nCREATE FUNCTION private.is_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSECURITY DEFINER\nSET search_path = ''\nSTABLE\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access  = 'editor'\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_editor(uuid) FROM public;\nGRANT  EXECUTE ON FUNCTION private.is_editor(uuid) TO authenticated;\n\n-- Trigger to enforce that org_id and owner_id are immutable after INSERT.\nCREATE FUNCTION private.records_check_immutable()\nRETURNS trigger\nLANGUAGE plpgsql\nSECURITY DEFINER\nSET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id    IS DISTINCT FROM OLD.org_id OR\n     NEW.owner_id  IS DISTINCT FROM OLD.owner_id\n  THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable'\n      USING ERRCODE = '42501';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_tg\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.records_check_immutable();\n\n-- \u2500\u2500 records policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- SELECT: all rows visible to everyone, published flag irrelevant.\nCREATE POLICY \"records_select_anon\" ON public.records\n  FOR SELECT TO anon\n  USING (true);\n\nCREATE POLICY \"records_select_authenticated\" ON public.records\n  FOR SELECT TO authenticated\n  USING (true);\n\n-- INSERT: editor of the target org only; owner_id must equal caller.\nCREATE POLICY \"records_insert\" ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT private.is_editor(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\n-- UPDATE: editor of the row's org only; immutability enforced by trigger above.\nCREATE POLICY \"records_update\" ON public.records\n  FOR UPDATE TO authenticated\n  USING     ((SELECT private.is_editor(org_id)))\n  WITH CHECK((SELECT private.is_editor(org_id)));\n\n-- DELETE: editor of the row's org only.\nCREATE POLICY \"records_delete\" ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT private.is_editor(org_id)));\n\n-- organizations, memberships, shares: RLS enabled above with no permissive\n-- policies \u2192 every client request is denied by default.\n"
        },
        {
          "stage": 2,
          "sha256": "a5b425e4476d48202e6a84e0658f4b111ad2bebdea505f52e13c4b4c1cdb2de4",
          "sql": "-- Drop the old unrestricted SELECT policies from 001.sql.\nDROP POLICY \"records_select_anon\"          ON public.records;\nDROP POLICY \"records_select_authenticated\" ON public.records;\n\n-- Anonymous: published records only.\nCREATE POLICY \"records_select_anon\" ON public.records\n  FOR SELECT TO anon\n  USING (published = true);\n\n-- Authenticated non-editors (and outsiders, viewers): published records only.\nCREATE POLICY \"records_select_published\" ON public.records\n  FOR SELECT TO authenticated\n  USING (published = true);\n\n-- Editors of the record's org also see unpublished drafts in their org.\n-- RLS ORs permissive policies, so this adds visibility on top of the above.\nCREATE POLICY \"records_select_own_org_editor\" ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_editor(org_id)));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 312195,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 227674
    },
    {
      "phase": "pilot-03",
      "id": "public-catalog-2-codex-baseline",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "capped",
      "resultSha256": "5ffa3946ae365935aaaf8c1c7f0430cb6c9e724adde9145db95bf04c63a0cf5c",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 163336,
          "wholeTreeTokens": 163336,
          "usageComplete": true,
          "actorElapsedMs": 44815,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "97f686206efb4f9571c6c1f13359f4aa8d574aa3a3bf5256b0717f82d4a42015",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "011cbdbd4fef5245346b1e7589603a3b6fe598a11a486319f2cf8bb46f2afac1"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 134876,
          "wholeTreeTokens": 134876,
          "usageComplete": true,
          "actorElapsedMs": 45662,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "65dfac0d60113babac8492d52317a728136efc2a4415997438d3a7445043f37d",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "7d72ccd4860e853bfe9714ce150890369240298a7ea10816ac5cfc09a6719d5b",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "97f686206efb4f9571c6c1f13359f4aa8d574aa3a3bf5256b0717f82d4a42015",
          "sql": "BEGIN;\nREVOKE ALL ON public.records, public.organizations, public.memberships, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_security;\nREVOKE ALL ON SCHEMA record_security FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_security TO authenticated;\nCREATE FUNCTION record_security.editor_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_security.editor_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_security.editor_orgs() TO authenticated;\nCREATE INDEX memberships_user_id_idx ON public.memberships(user_id);\nCREATE INDEX records_org_id_idx ON public.records(org_id);\n\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\n-- Column privileges enforce immutability, including moves between two editable orgs.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_public_read ON public.records FOR SELECT TO anon, authenticated USING (true);\nCREATE POLICY records_editor_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (owner_id = (SELECT auth.uid()) AND org_id IN (SELECT record_security.editor_orgs()));\nCREATE POLICY records_editor_update ON public.records FOR UPDATE TO authenticated\n USING (org_id IN (SELECT record_security.editor_orgs()))\n WITH CHECK (org_id IN (SELECT record_security.editor_orgs()));\nCREATE POLICY records_editor_delete ON public.records FOR DELETE TO authenticated\n USING (org_id IN (SELECT record_security.editor_orgs()));\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "65dfac0d60113babac8492d52317a728136efc2a4415997438d3a7445043f37d",
          "sql": "BEGIN;\n-- Replace the permissive public read rule; write policies and grants stay intact.\nALTER POLICY records_public_read ON public.records USING (published = true);\nCREATE POLICY records_editor_read ON public.records\n FOR SELECT TO authenticated\n USING (org_id IN (SELECT record_security.editor_orgs()));\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 298212,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 90477
    },
    {
      "phase": "pilot-03",
      "id": "public-catalog-2-codex-skill",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "capped",
      "resultSha256": "ac6fac73f9203600fa4be4685dc1f7e5099e802101f2e3dc4d08e821474c2408",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 206454,
          "wholeTreeTokens": 206454,
          "usageComplete": true,
          "actorElapsedMs": 47295,
          "observedModel": null,
          "toolCommands": 7,
          "skillReadCommandObserved": true,
          "migrationSha256": "b9015046b194563611f517cc0edead81e8c3974cc21e7d33003f9945a32ccbbf",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "3547b645f75a88468422c1e4ce7440f4e5430fd9bdff7d1821f0af3b1ee5ca02"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 94450,
          "wholeTreeTokens": 94450,
          "usageComplete": true,
          "actorElapsedMs": 39962,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "e8fe87325288fa67ab76c592c27c18bc066d2eaa05e3d382649ba570b48bbb7f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "9d72e2b96e512170cc002d974e3fd28824d712bfd346fae41f1223fc2f7c77fa",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "b9015046b194563611f517cc0edead81e8c3974cc21e7d33003f9945a32ccbbf",
          "sql": "BEGIN;\nREVOKE ALL ON public.records, public.organizations, public.memberships, public.shares\n  FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n-- The table owner can inspect memberships; clients cannot. Never accept a\n-- caller-supplied user identity or rely on the caller's search_path.\nCREATE FUNCTION record_access.is_editor(target_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships AS m\n    WHERE m.org_id = target_org\n      AND m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n  );\n$$;\nREVOKE ALL ON FUNCTION record_access.is_editor(uuid) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION record_access.is_editor(uuid) TO authenticated;\n\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\n-- No table-level UPDATE grant: these columns are the complete update API.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_public_read ON public.records FOR SELECT\n  TO anon, authenticated USING (true);\nCREATE POLICY records_editor_insert ON public.records FOR INSERT\n  TO authenticated WITH CHECK (\n    owner_id = (SELECT auth.uid()) AND record_access.is_editor(org_id)\n  );\nCREATE POLICY records_editor_update ON public.records FOR UPDATE\n  TO authenticated USING (record_access.is_editor(org_id))\n  WITH CHECK (record_access.is_editor(org_id));\nCREATE POLICY records_editor_delete ON public.records FOR DELETE\n  TO authenticated USING (record_access.is_editor(org_id));\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "e8fe87325288fa67ab76c592c27c18bc066d2eaa05e3d382649ba570b48bbb7f",
          "sql": "BEGIN;\n\n-- Replace the unrestricted read condition; permissive SELECT policies combine\n-- with OR, so leaving USING (true) would continue exposing drafts.\nALTER POLICY records_public_read ON public.records\n  USING (published = true);\n\n-- Editors can read every record in their organization, including drafts owned\n-- by other editors. Keep the membership helper restricted to authenticated.\nCREATE POLICY records_editor_read ON public.records\n  FOR SELECT TO authenticated\n  USING (record_access.is_editor(org_id));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 300904,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 87257
    },
    {
      "phase": "pilot-03",
      "id": "document-sharing-1-codex-baseline",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "capped",
      "resultSha256": "88435d07f51a2f17a5192bc2dfc6ebdcba0d4f6db4ba596ce5ea244c38b0851b",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 136909,
          "wholeTreeTokens": 136909,
          "usageComplete": true,
          "actorElapsedMs": 55536,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "56d13a6bcca3a60e4149dcdf8ad5a2b31a3f85d0392bd6d0da0fc9648da9f8b5",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "de3744d078c1fcb49ffe051b21c6c2391c7f40c31f2c39ca07b8a64ee107f7a6"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 95841,
          "wholeTreeTokens": 95841,
          "usageComplete": true,
          "actorElapsedMs": 38507,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "bcd5997c67eb945213d8525f4cef6902f5374e0df1e5ce97254c96fcdb83c60a",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "6819542f2206cc999b33f556b36ad828c9659b0242598d3c410dc6fed0b15782",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "56d13a6bcca3a60e4149dcdf8ad5a2b31a3f85d0392bd6d0da0fc9648da9f8b5",
          "sql": "BEGIN;\nREVOKE ALL ON public.records, public.shares, public.organizations, public.memberships FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- Column privileges make both tenant and ownership immutable, including upserts.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n\n-- These helpers run as the table owner, breaking the records/shares RLS cycle.\n-- Neither accepts a caller-supplied identity, nor exposes other users' shares.\nCREATE FUNCTION record_access.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT s.record_id FROM public.shares AS s WHERE s.user_id = (SELECT auth.uid())\n$$;\nCREATE FUNCTION record_access.can_create_in(target_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT EXISTS (SELECT 1 FROM public.memberships AS m\n WHERE m.org_id = target_org AND m.user_id = (SELECT auth.uid()) AND m.access = 'editor')\n$$;\nREVOKE ALL ON FUNCTION record_access.shared_record_ids(), record_access.can_create_in(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.shared_record_ids(), record_access.can_create_in(uuid) TO authenticated;\n\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n USING (owner_id = (SELECT auth.uid()) OR id IN (SELECT record_access.shared_record_ids()));\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (owner_id = (SELECT auth.uid()) AND record_access.can_create_in(org_id));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n USING (owner_id = (SELECT auth.uid())) WITH CHECK (owner_id = (SELECT auth.uid()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n USING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n WITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())))\n WITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE INDEX records_owner_id_idx ON public.records(owner_id);\nCREATE INDEX shares_user_id_idx ON public.shares(user_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "bcd5997c67eb945213d8525f4cef6902f5374e0df1e5ce97254c96fcdb83c60a",
          "sql": "BEGIN;\n-- Evaluate current share state for each statement; retain the owner-only share API.\nCREATE OR REPLACE FUNCTION record_access.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT s.record_id\n FROM public.shares AS s\n WHERE s.user_id = (SELECT auth.uid()) AND s.active = true\n$$;\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 232750,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 94043
    },
    {
      "phase": "pilot-03",
      "id": "document-sharing-1-codex-skill",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "capped",
      "resultSha256": "ccea22f51c1ca04202b8c5b24ddbf059fc87f4409c2d4c6db61568949a6f6890",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 133494,
          "wholeTreeTokens": 133494,
          "usageComplete": true,
          "actorElapsedMs": 43887,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "fdcb6fa0284d854371ffff3e7d20c8a0d20d304cdcb770e6150a2a8bf5ca9ae9",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "991fcb14db1b7a552e24ec32e4e17603c29199b744a7c4ab1874a4f28e4fc198"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 165838,
          "wholeTreeTokens": 165838,
          "usageComplete": true,
          "actorElapsedMs": 46588,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "123c811f586424420a47c892b295743c48a84563283710547a3c72722a17c293",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "916c6980381758732b9f643e9a1ae9ce90d421ca609b1005bd0a085bc0e7e8af",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "fdcb6fa0284d854371ffff3e7d20c8a0d20d304cdcb770e6150a2a8bf5ca9ae9",
          "sql": "BEGIN;\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n\n-- The table owner bypasses RLS in these narrowly scoped, identity-bound lookups.\n-- Do not FORCE RLS on shares: this helper breaks the records/shares policy cycle.\nCREATE FUNCTION record_access.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT record_id FROM public.shares WHERE user_id = (SELECT auth.uid())\n$$;\nCREATE FUNCTION record_access.editor_org_ids() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT org_id FROM public.memberships\n WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_access.shared_record_ids(), record_access.editor_org_ids() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.shared_record_ids(), record_access.editor_org_ids() TO authenticated;\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- No table-level UPDATE grant: ownership and organization cannot be reassigned.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n USING (owner_id = (SELECT auth.uid()) OR id IN (SELECT record_access.shared_record_ids()));\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (owner_id = (SELECT auth.uid()) AND org_id IN (SELECT record_access.editor_org_ids()));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n USING (owner_id = (SELECT auth.uid())) WITH CHECK (owner_id = (SELECT auth.uid()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n USING (owner_id = (SELECT auth.uid()));\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n WITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())))\n WITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n USING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE INDEX records_owner_idx ON public.records(owner_id);\nCREATE INDEX records_org_idx ON public.records(org_id);\nCREATE INDEX shares_user_record_idx ON public.shares(user_id, record_id);\nCREATE INDEX memberships_user_idx ON public.memberships(user_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "123c811f586424420a47c892b295743c48a84563283710547a3c72722a17c293",
          "sql": "BEGIN;\n\n-- Keep the policy-cycle-breaking lookup identity-bound, but honor revocation.\n-- STABLE uses the current statement snapshot, rather than caching across statements.\nCREATE OR REPLACE FUNCTION record_access.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n SELECT record_id\n FROM public.shares\n WHERE user_id = (SELECT auth.uid()) AND active IS TRUE\n$$;\n\n-- CREATE OR REPLACE preserves the existing owner and execution grants.\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 299332,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 90475
    },
    {
      "phase": "pilot-03",
      "id": "document-sharing-1-claude-baseline",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "capped",
      "resultSha256": "0626deeeeca767a16b0c4a07817c03a9d6a8dafc9f5ff726ac341dd61239c832",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 39,
          "totalChecks": 41
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  23514: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  23514: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  23514: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  23514: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.tg_records_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 370196,
          "wholeTreeTokens": 370196,
          "usageComplete": true,
          "actorElapsedMs": 262771,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "142ec3a531beb9f6f89fd72dab1804e203b6530beabbe664c29cd3e2d2885392",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "de0c6db7b9bea1ac8c401033753873665b46aa9fb7358e6c1ab6f483b7793993"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 215562,
          "wholeTreeTokens": 215562,
          "usageComplete": true,
          "actorElapsedMs": 80166,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "85da8d45f70d578afbb36484cd169e1ae670ceeb495096e3f7bfa8c323888724",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "8f98f7f0f5d7a0c5b0c6031c30ca82b1e24285d385be8d633ec103c74228791d",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "142ec3a531beb9f6f89fd72dab1804e203b6530beabbe664c29cd3e2d2885392",
          "sql": "-- private schema: security-definer helpers owned by migrator (table owner, no FORCE RLS)\n-- so they bypass RLS on public tables \u2014 breaks the records<->shares policy cycle.\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Reads shares without triggering shares RLS\nCREATE FUNCTION private.has_share(p_record_id integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS(\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id\n      AND user_id = (SELECT auth.uid())\n  )\n$$;\n\n-- Reads records without triggering records RLS\nCREATE FUNCTION private.record_owner_id(p_record_id integer)\nRETURNS uuid LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT owner_id FROM public.records WHERE id = p_record_id\n$$;\n\n-- Reads memberships without triggering memberships RLS\nCREATE FUNCTION private.is_editor_member(p_org_id uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS(\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.has_share(integer)      FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.record_owner_id(integer) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_editor_member(uuid)  FROM PUBLIC;\n\n-- authenticated needs EXECUTE so policy expressions can call these functions\nGRANT USAGE ON SCHEMA private TO authenticated;\nGRANT EXECUTE ON FUNCTION private.has_share(integer)      TO authenticated;\nGRANT EXECUTE ON FUNCTION private.record_owner_id(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_editor_member(uuid)  TO authenticated;\n\n-- Trigger: enforce org_id and owner_id immutability on records\nCREATE FUNCTION public.tg_records_immutable()\nRETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id OR\n     NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable' USING ERRCODE = '23514';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION public.tg_records_immutable();\n\n-- Lock down organizations: clients may never edit it\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\n\n-- Lock down memberships: clients may never edit it\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nREVOKE ALL ON TABLE public.memberships FROM anon, authenticated;\n\n-- \u2500\u2500 records \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nREVOKE ALL ON TABLE public.records FROM anon, authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records TO authenticated;\n\n-- Owner sees all their rows; shared users see individually shared rows only\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n  USING (\n    (SELECT auth.uid()) = owner_id\n    OR private.has_share(id)\n  );\n\n-- Creator must own the new row AND be an editor in the target org\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT auth.uid()) = owner_id\n    AND private.is_editor_member(org_id)\n  );\n\n-- Only the owner may update their own rows; immutable fields enforced by trigger\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n  USING     ((SELECT auth.uid()) = owner_id)\n  WITH CHECK((SELECT auth.uid()) = owner_id);\n\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n  USING ((SELECT auth.uid()) = owner_id);\n\n-- \u2500\u2500 shares \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nREVOKE ALL ON TABLE public.shares FROM anon, authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares TO authenticated;\n\n-- Only the record owner manages share rows\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n  USING (private.record_owner_id(record_id) = (SELECT auth.uid()));\n\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n  WITH CHECK (private.record_owner_id(record_id) = (SELECT auth.uid()));\n\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n  USING     (private.record_owner_id(record_id) = (SELECT auth.uid()))\n  WITH CHECK(private.record_owner_id(record_id) = (SELECT auth.uid()));\n\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n  USING (private.record_owner_id(record_id) = (SELECT auth.uid()));\n\n-- \u2500\u2500 indexes on policy filter columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nCREATE INDEX records_owner_id_idx   ON public.records    USING btree (owner_id);\n-- memberships PK is (org_id, user_id); user_id is not the leading column\nCREATE INDEX memberships_user_id_idx ON public.memberships USING btree (user_id);\n-- shares PK is (record_id, user_id); user_id is not the leading column\nCREATE INDEX shares_user_id_idx      ON public.shares      USING btree (user_id);\n"
        },
        {
          "stage": 2,
          "sha256": "85da8d45f70d578afbb36484cd169e1ae670ceeb495096e3f7bfa8c323888724",
          "sql": "-- Only active=true share rows now grant read access.\n-- Replace has_share to add the active filter; all other policies from 001.sql\n-- remain correct (shares are already owner-only, so recipients cannot inspect,\n-- reactivate, create, change, or delete shares).\nCREATE OR REPLACE FUNCTION private.has_share(p_record_id integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS(\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id\n      AND user_id   = (SELECT auth.uid())\n      AND active    = true\n  )\n$$;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 585758,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 342937
    },
    {
      "phase": "pilot-03",
      "id": "document-sharing-1-claude-skill",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "capped",
      "resultSha256": "b240d33ff63e59e4fdd134f969a89936a32e675edcbed1c867e2ff9e8f2ff00e",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 39,
          "totalChecks": 41
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_fields() line 6 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 703859,
          "wholeTreeTokens": 703859,
          "usageComplete": true,
          "actorElapsedMs": 359225,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 19,
          "skillReadCommandObserved": true,
          "migrationSha256": "58725588b110c9491c067ffe149cee28a9055e09d32fdcce2e30321dc09b957e",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "e857603643c9ac58a357473a964ec684d3fa837f7287e65fd9c817488a1553fb"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 382352,
          "wholeTreeTokens": 382352,
          "usageComplete": true,
          "actorElapsedMs": 156830,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 18,
          "skillReadCommandObserved": true,
          "migrationSha256": "3c112c7e7f122bb071cc0564876696940dff33932125f7fc315a2e325fa3af07",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "cbf573c7bead24b74c66891a572a9d2d58b7c5296217ca6e3deabb2fcdc4433d",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "58725588b110c9491c067ffe149cee28a9055e09d32fdcce2e30321dc09b957e",
          "sql": "-- Private schema for security-definer helpers (not exposed to clients)\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Reads memberships as the table owner, bypassing any public grants.\n-- Used in records INSERT policy to verify editor membership.\nCREATE FUNCTION private.is_editor_member(p_org_id uuid, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = p_user_id\n      AND access = 'editor'\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_editor_member(uuid, uuid) FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_editor_member(uuid, uuid) TO authenticated;\n\n-- Reads shares as the table owner (bypasses shares RLS).\n-- Used in records SELECT policy to break the records<->shares policy cycle:\n-- records SELECT checks shares, shares SELECT checks records via direct subquery,\n-- records SELECT would re-enter shares \u2014 this function stops that recursion.\nCREATE FUNCTION private.has_share_access(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id AND user_id = p_user_id\n  )\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.has_share_access(integer, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.has_share_access(integer, uuid) TO authenticated;\n\n-- Prevents org_id and owner_id from being changed on UPDATE.\nCREATE FUNCTION private.records_immutable_fields()\nRETURNS trigger\nLANGUAGE plpgsql\nSET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id\n     OR NEW.owner_id IS DISTINCT FROM OLD.owner_id\n  THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable' USING ERRCODE = 'P0001';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_fields\nBEFORE UPDATE ON public.records\nFOR EACH ROW EXECUTE FUNCTION private.records_immutable_fields();\n\n-- Enable RLS on every table in the public schema\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships    ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records        ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares         ENABLE ROW LEVEL SECURITY;\n\n-- Strip any existing grants from client roles, then re-grant only what is needed\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\nREVOKE ALL ON TABLE public.memberships   FROM anon, authenticated;\nREVOKE ALL ON TABLE public.records       FROM anon, authenticated;\nREVOKE ALL ON TABLE public.shares        FROM anon, authenticated;\n\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares  TO authenticated;\n\n-- Indexes for policy filter columns (RLS evaluates per candidate row)\nCREATE INDEX records_owner_id_idx     ON public.records USING btree (owner_id);\nCREATE INDEX shares_user_id_idx       ON public.shares  USING btree (user_id);\nCREATE INDEX memberships_user_id_idx  ON public.memberships USING btree (user_id);\n\n-- \u2500\u2500 records policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Owner sees all their records; any user with a share row sees that record.\n-- active flag is ignored in this initial version (share row presence is enough).\nCREATE POLICY \"records_select\"\nON public.records FOR SELECT TO authenticated\nUSING (\n  (SELECT auth.uid()) = owner_id\n  OR private.has_share_access(id, (SELECT auth.uid()))\n);\n\n-- Creator must be an editor of the target org and must set themselves as owner.\nCREATE POLICY \"records_insert\"\nON public.records FOR INSERT TO authenticated\nWITH CHECK (\n  (SELECT auth.uid()) = owner_id\n  AND private.is_editor_member(org_id, (SELECT auth.uid()))\n);\n\n-- Only the owner may update their records.\n-- The trigger above enforces that org_id and owner_id cannot change.\nCREATE POLICY \"records_update\"\nON public.records FOR UPDATE TO authenticated\nUSING     ((SELECT auth.uid()) = owner_id)\nWITH CHECK ((SELECT auth.uid()) = owner_id);\n\nCREATE POLICY \"records_delete\"\nON public.records FOR DELETE TO authenticated\nUSING ((SELECT auth.uid()) = owner_id);\n\n-- \u2500\u2500 shares policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Only the record owner may read or write share rows.\n-- The EXISTS subquery reads records through their RLS policy; private.has_share_access\n-- (called inside records SELECT) reads shares as the table owner, terminating the cycle.\n\nCREATE POLICY \"shares_select\"\nON public.shares FOR SELECT TO authenticated\nUSING (\n  EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = record_id AND r.owner_id = (SELECT auth.uid())\n  )\n);\n\nCREATE POLICY \"shares_insert\"\nON public.shares FOR INSERT TO authenticated\nWITH CHECK (\n  EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = record_id AND r.owner_id = (SELECT auth.uid())\n  )\n);\n\nCREATE POLICY \"shares_update\"\nON public.shares FOR UPDATE TO authenticated\nUSING (\n  EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = record_id AND r.owner_id = (SELECT auth.uid())\n  )\n)\nWITH CHECK (\n  EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = record_id AND r.owner_id = (SELECT auth.uid())\n  )\n);\n\nCREATE POLICY \"shares_delete\"\nON public.shares FOR DELETE TO authenticated\nUSING (\n  EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = record_id AND r.owner_id = (SELECT auth.uid())\n  )\n);\n"
        },
        {
          "stage": 2,
          "sha256": "3c112c7e7f122bb071cc0564876696940dff33932125f7fc315a2e325fa3af07",
          "sql": "-- Replace the share-access helper to honour the active flag.\n-- Previously any share row granted read access; now only active=true rows do.\nCREATE OR REPLACE FUNCTION private.has_share_access(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id\n      AND user_id = p_user_id\n      AND active = true\n  )\n$$;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 1086211,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 516055
    },
    {
      "phase": "pilot-03",
      "id": "document-sharing-2-claude-baseline",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "capped",
      "resultSha256": "99cb6ed9b93aafb6d413e3eafdafbe23a29e5bbece6ff196587e77ef6654d3d4",
      "protocolHash": "bd5fc23804e3ba11fb56dfe3c8854057d6f589ed586f7c0765085b6595a531bf",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": false,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 39,
          "totalChecks": 41
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 315963,
          "wholeTreeTokens": 315963,
          "usageComplete": true,
          "actorElapsedMs": 196729,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "546a1ace556b23c92ad12c1e4c36059dd5bcca3ff4ad8758a9feb30efdf9ae0b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "ee342b0f7239de37723eb7a77fab6be31f57894fe2f5d84aa707b25fa0307e39"
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "546a1ace556b23c92ad12c1e4c36059dd5bcca3ff4ad8758a9feb30efdf9ae0b",
          "sql": "-- Private schema for security-definer helpers that break potential RLS cycles\n-- and keep memberships/organizations invisible to client roles.\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Returns record IDs that have a share entry for the calling user.\n-- Security definer runs as migrator (table owner), which bypasses RLS,\n-- so policies on shares never re-enter while evaluating records policies.\nCREATE FUNCTION private.records_shared_with_me()\nRETURNS SETOF integer\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT record_id FROM public.shares\n  WHERE user_id = (SELECT auth.uid())\n$$;\n\n-- Returns true when the calling user owns the given record.\n-- Security definer avoids a cycle when called from shares policies.\nCREATE FUNCTION private.is_record_owner(p_record_id integer)\nRETURNS boolean\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records\n    WHERE id = p_record_id\n      AND owner_id = (SELECT auth.uid())\n  )\n$$;\n\n-- Returns true when the calling user is an editor member of the given org.\n-- Security definer keeps memberships invisible to client roles.\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  )\n$$;\n\n-- Restrict private helper execution to authenticated only.\nREVOKE EXECUTE ON FUNCTION private.records_shared_with_me() FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_record_owner(integer) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\nGRANT EXECUTE ON FUNCTION private.records_shared_with_me() TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_record_owner(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- organizations and memberships: no client access at all.\n-- The helpers above read them as migrator internally.\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\nREVOKE ALL ON TABLE public.memberships  FROM anon, authenticated;\n\n-- Grant precise operations on records/shares to authenticated only.\n-- anon gets nothing, so the engine raises 42501 before any policy runs.\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares  TO authenticated;\n\n-- Enable RLS on the two exposed tables.\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares  ENABLE ROW LEVEL SECURITY;\n\n-- Enforce org_id and owner_id immutability at the trigger level.\n-- RLS WITH CHECK sees only the new row, not the old one, so a trigger is needed.\nCREATE FUNCTION public.tg_records_immutable()\nRETURNS trigger LANGUAGE plpgsql AS $$\nBEGIN\n  IF NEW.org_id <> OLD.org_id OR NEW.owner_id <> OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable\nBEFORE UPDATE ON public.records\nFOR EACH ROW EXECUTE FUNCTION public.tg_records_immutable();\n\n-- \u2500\u2500 records policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Owner sees all their records; share recipients see only their named records.\nCREATE POLICY records_select ON public.records\nFOR SELECT TO authenticated\nUSING (\n  owner_id = (SELECT auth.uid())\n  OR id IN (SELECT private.records_shared_with_me())\n);\n\n-- Creation requires: caller is an editor of the target org, and owner_id = caller.\nCREATE POLICY records_insert ON public.records\nFOR INSERT TO authenticated\nWITH CHECK (\n  owner_id = (SELECT auth.uid())\n  AND private.is_org_editor(org_id)\n);\n\n-- Only the owner may update their own records.\nCREATE POLICY records_update ON public.records\nFOR UPDATE TO authenticated\nUSING   (owner_id = (SELECT auth.uid()))\nWITH CHECK (owner_id = (SELECT auth.uid()));\n\n-- Only the owner may delete their own records.\nCREATE POLICY records_delete ON public.records\nFOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\n-- \u2500\u2500 shares policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Only the record owner sees share rows.\nCREATE POLICY shares_select ON public.shares\nFOR SELECT TO authenticated\nUSING (private.is_record_owner(record_id));\n\n-- Only the record owner may add share rows.\nCREATE POLICY shares_insert ON public.shares\nFOR INSERT TO authenticated\nWITH CHECK (private.is_record_owner(record_id));\n\n-- Only the record owner may update share rows.\nCREATE POLICY shares_update ON public.shares\nFOR UPDATE TO authenticated\nUSING   (private.is_record_owner(record_id))\nWITH CHECK (private.is_record_owner(record_id));\n\n-- Only the record owner may delete share rows.\nCREATE POLICY shares_delete ON public.shares\nFOR DELETE TO authenticated\nUSING (private.is_record_owner(record_id));\n\n-- \u2500\u2500 indexes for RLS filter columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nCREATE INDEX records_owner_id_idx  ON public.records USING btree (owner_id);\nCREATE INDEX shares_user_id_idx    ON public.shares  USING btree (user_id);\nCREATE INDEX shares_record_id_idx  ON public.shares  USING btree (record_id);\nCREATE INDEX memberships_user_id_idx ON public.memberships USING btree (user_id);\n"
        }
      ],
      "completeTwoStages": false,
      "stageDisposition": "follow-up precluded or interrupted; see phase/migration record",
      "newSessionTokens": 315963,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 196729
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "document-sharing-2-claude-baseline",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "mixed capped\u2192uncapped",
      "resultSha256": "f88e54bc7005246858431d41d571334a16e1518f0edb6c21ab2adbbb9a51c791",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 39,
          "totalChecks": 41
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function tg_records_immutable() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 315963,
          "wholeTreeTokens": 315963,
          "usageComplete": true,
          "actorElapsedMs": 196729,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "546a1ace556b23c92ad12c1e4c36059dd5bcca3ff4ad8758a9feb30efdf9ae0b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": true,
          "receiptSha256": "ee342b0f7239de37723eb7a77fab6be31f57894fe2f5d84aa707b25fa0307e39"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 109857,
          "wholeTreeTokens": 109857,
          "usageComplete": true,
          "actorElapsedMs": 46275,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 12,
          "skillReadCommandObserved": false,
          "migrationSha256": "9afb78c2a54fa92c318a80696be20f2bec8f3e9e3012bc015b1199adb4c83006",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "4d8767da7bee67e9db31ec6a33ed85df917868fdf362296e840b355086bb04ab",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "546a1ace556b23c92ad12c1e4c36059dd5bcca3ff4ad8758a9feb30efdf9ae0b",
          "sql": "-- Private schema for security-definer helpers that break potential RLS cycles\n-- and keep memberships/organizations invisible to client roles.\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Returns record IDs that have a share entry for the calling user.\n-- Security definer runs as migrator (table owner), which bypasses RLS,\n-- so policies on shares never re-enter while evaluating records policies.\nCREATE FUNCTION private.records_shared_with_me()\nRETURNS SETOF integer\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT record_id FROM public.shares\n  WHERE user_id = (SELECT auth.uid())\n$$;\n\n-- Returns true when the calling user owns the given record.\n-- Security definer avoids a cycle when called from shares policies.\nCREATE FUNCTION private.is_record_owner(p_record_id integer)\nRETURNS boolean\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records\n    WHERE id = p_record_id\n      AND owner_id = (SELECT auth.uid())\n  )\n$$;\n\n-- Returns true when the calling user is an editor member of the given org.\n-- Security definer keeps memberships invisible to client roles.\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  )\n$$;\n\n-- Restrict private helper execution to authenticated only.\nREVOKE EXECUTE ON FUNCTION private.records_shared_with_me() FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_record_owner(integer) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\nGRANT EXECUTE ON FUNCTION private.records_shared_with_me() TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_record_owner(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- organizations and memberships: no client access at all.\n-- The helpers above read them as migrator internally.\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\nREVOKE ALL ON TABLE public.memberships  FROM anon, authenticated;\n\n-- Grant precise operations on records/shares to authenticated only.\n-- anon gets nothing, so the engine raises 42501 before any policy runs.\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares  TO authenticated;\n\n-- Enable RLS on the two exposed tables.\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares  ENABLE ROW LEVEL SECURITY;\n\n-- Enforce org_id and owner_id immutability at the trigger level.\n-- RLS WITH CHECK sees only the new row, not the old one, so a trigger is needed.\nCREATE FUNCTION public.tg_records_immutable()\nRETURNS trigger LANGUAGE plpgsql AS $$\nBEGIN\n  IF NEW.org_id <> OLD.org_id OR NEW.owner_id <> OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable\nBEFORE UPDATE ON public.records\nFOR EACH ROW EXECUTE FUNCTION public.tg_records_immutable();\n\n-- \u2500\u2500 records policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Owner sees all their records; share recipients see only their named records.\nCREATE POLICY records_select ON public.records\nFOR SELECT TO authenticated\nUSING (\n  owner_id = (SELECT auth.uid())\n  OR id IN (SELECT private.records_shared_with_me())\n);\n\n-- Creation requires: caller is an editor of the target org, and owner_id = caller.\nCREATE POLICY records_insert ON public.records\nFOR INSERT TO authenticated\nWITH CHECK (\n  owner_id = (SELECT auth.uid())\n  AND private.is_org_editor(org_id)\n);\n\n-- Only the owner may update their own records.\nCREATE POLICY records_update ON public.records\nFOR UPDATE TO authenticated\nUSING   (owner_id = (SELECT auth.uid()))\nWITH CHECK (owner_id = (SELECT auth.uid()));\n\n-- Only the owner may delete their own records.\nCREATE POLICY records_delete ON public.records\nFOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\n-- \u2500\u2500 shares policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Only the record owner sees share rows.\nCREATE POLICY shares_select ON public.shares\nFOR SELECT TO authenticated\nUSING (private.is_record_owner(record_id));\n\n-- Only the record owner may add share rows.\nCREATE POLICY shares_insert ON public.shares\nFOR INSERT TO authenticated\nWITH CHECK (private.is_record_owner(record_id));\n\n-- Only the record owner may update share rows.\nCREATE POLICY shares_update ON public.shares\nFOR UPDATE TO authenticated\nUSING   (private.is_record_owner(record_id))\nWITH CHECK (private.is_record_owner(record_id));\n\n-- Only the record owner may delete share rows.\nCREATE POLICY shares_delete ON public.shares\nFOR DELETE TO authenticated\nUSING (private.is_record_owner(record_id));\n\n-- \u2500\u2500 indexes for RLS filter columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nCREATE INDEX records_owner_id_idx  ON public.records USING btree (owner_id);\nCREATE INDEX shares_user_id_idx    ON public.shares  USING btree (user_id);\nCREATE INDEX shares_record_id_idx  ON public.shares  USING btree (record_id);\nCREATE INDEX memberships_user_id_idx ON public.memberships USING btree (user_id);\n"
        },
        {
          "stage": 2,
          "sha256": "9afb78c2a54fa92c318a80696be20f2bec8f3e9e3012bc015b1199adb4c83006",
          "sql": "-- Replace the shared-records helper to honour the active flag.\n-- Only active=true share rows grant read access to records.\nCREATE OR REPLACE FUNCTION private.records_shared_with_me()\nRETURNS SETOF integer\nLANGUAGE sql SECURITY DEFINER SET search_path = ''\nSTABLE AS $$\n  SELECT record_id FROM public.shares\n  WHERE user_id = (SELECT auth.uid())\n    AND active = true\n$$;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 109857,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 46275
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "document-sharing-2-claude-skill",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "f550cf0ad436143e73184788726e4ba44211ad6c358b743172cfc9ff982a0f2a",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 39,
          "totalChecks": 41
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 329201,
          "wholeTreeTokens": 329201,
          "usageComplete": true,
          "actorElapsedMs": 235386,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 16,
          "skillReadCommandObserved": true,
          "migrationSha256": "e9c0b2e272a705ef99fcd9aa64f50d1c9fa9fbe836a78a1b7a3b7bae8f252168",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "73b6d07048da2631a0a4587751701099d4480fbaa78f6b839570dff111c494e5"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 77464,
          "wholeTreeTokens": 77464,
          "usageComplete": true,
          "actorElapsedMs": 42524,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 8,
          "skillReadCommandObserved": true,
          "migrationSha256": "6523c7e14dee81cdee3b8dc332ad41e78f28efb4387d113a653d8ca5b0f32c96",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "304dd8ef768d3e22f3b42e67890b85fd65dad0e784168e5e2dc2043217be9139",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "e9c0b2e272a705ef99fcd9aa64f50d1c9fa9fbe836a78a1b7a3b7bae8f252168",
          "sql": "-- Private schema for security-definer helpers (keeps them off the public API)\nCREATE SCHEMA IF NOT EXISTS private;\n\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Checks org editor membership for INSERT policy.\n-- SECURITY DEFINER: authenticated never needs SELECT on memberships directly.\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  );\n$$;\n\n-- Checks share existence for the records SELECT policy.\n-- SECURITY DEFINER: breaks the records\u2192shares\u2192records RLS recursion cycle.\nCREATE OR REPLACE FUNCTION private.has_share_access(p_record_id integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id\n      AND user_id = (SELECT auth.uid())\n  );\n$$;\n\n-- Checks record ownership for the shares ALL policy.\n-- SECURITY DEFINER: breaks the shares\u2192records\u2192shares RLS recursion cycle.\nCREATE OR REPLACE FUNCTION private.is_record_owner(p_record_id integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records\n    WHERE id = p_record_id\n      AND owner_id = (SELECT auth.uid())\n  );\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_org_editor(uuid)     FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.has_share_access(integer) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.is_record_owner(integer)  FROM PUBLIC;\n\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid)      TO authenticated;\nGRANT EXECUTE ON FUNCTION private.has_share_access(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_record_owner(integer)  TO authenticated;\n\n-- Table-level grants (anon gets nothing)\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares  TO authenticated;\n\n-- Enable RLS\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares  ENABLE ROW LEVEL SECURITY;\n\n-- \u2500\u2500 records policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Owner sees their own records\nCREATE POLICY records_select_owner ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT auth.uid()) = owner_id);\n\n-- Share recipient sees a record when any share row exists (active flag irrelevant for now)\nCREATE POLICY records_select_shared ON public.records\n  FOR SELECT TO authenticated\n  USING (private.has_share_access(id));\n\n-- Insert: caller must be an org editor and must set themselves as owner\nCREATE POLICY records_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT auth.uid()) = owner_id\n    AND private.is_org_editor(org_id)\n  );\n\n-- Update: only the owner; org_id/owner_id immutability enforced by trigger below\nCREATE POLICY records_update ON public.records\n  FOR UPDATE TO authenticated\n  USING  ((SELECT auth.uid()) = owner_id)\n  WITH CHECK ((SELECT auth.uid()) = owner_id);\n\n-- Delete: only the owner\nCREATE POLICY records_delete ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT auth.uid()) = owner_id);\n\n-- Trigger: make org_id and owner_id immutable on UPDATE\nCREATE OR REPLACE FUNCTION private.records_immutable_cols()\nRETURNS trigger LANGUAGE plpgsql AS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_cols\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.records_immutable_cols();\n\n-- \u2500\u2500 shares policies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Only the record owner may read or write share rows\nCREATE POLICY shares_owner ON public.shares\n  FOR ALL TO authenticated\n  USING     (private.is_record_owner(record_id))\n  WITH CHECK (private.is_record_owner(record_id));\n\n-- \u2500\u2500 Indexes for RLS policy columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCREATE INDEX IF NOT EXISTS records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX IF NOT EXISTS records_org_id_idx   ON public.records (org_id);\nCREATE INDEX IF NOT EXISTS shares_user_id_idx   ON public.shares  (user_id);\n"
        },
        {
          "stage": 2,
          "sha256": "6523c7e14dee81cdee3b8dc332ad41e78f28efb4387d113a653d8ca5b0f32c96",
          "sql": "-- Only active=true shares grant read access; inactive shares are treated as revoked.\nCREATE OR REPLACE FUNCTION private.has_share_access(p_record_id integer)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares\n    WHERE record_id = p_record_id\n      AND user_id = (SELECT auth.uid())\n      AND active = true\n  );\n$$;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 406665,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 277910
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "document-sharing-2-codex-baseline",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "c36f4a6f20f8da57a71944ffc5adf01d892fe3bc7ad76578cf7db221507278ea",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 112731,
          "wholeTreeTokens": 112731,
          "usageComplete": true,
          "actorElapsedMs": 55784,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "0756347c8e71cb9f2def81031383186dc823103967ebd10d02f0c2ef11892f99",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "0f0b6f1b98419f48ef6a9966089723a167c992ca5f02fb41c39267403756319b"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 120569,
          "wholeTreeTokens": 120569,
          "usageComplete": true,
          "actorElapsedMs": 53221,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "7817e27b609bfc8c07b92b8e1bcbfcec755e216a38164085dac116314404edca",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "8a3a5fd7af3a20f940b1aea82aa0fedd9a256b7211ec8f6e0d9c848cfcef1f5f",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "0756347c8e71cb9f2def81031383186dc823103967ebd10d02f0c2ef11892f99",
          "sql": "BEGIN;\nCREATE SCHEMA access_private;\nREVOKE ALL ON SCHEMA access_private FROM PUBLIC;\nGRANT USAGE ON SCHEMA access_private TO authenticated;\n\n-- These narrowly scoped helpers run as the table owner, avoiding policy cycles.\n-- Caller identity always comes from the trusted authentication setting.\nCREATE FUNCTION access_private.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT record_id FROM public.shares WHERE user_id = (SELECT auth.uid())\n$$;\nCREATE FUNCTION access_private.owned_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT id FROM public.records WHERE owner_id = (SELECT auth.uid())\n$$;\nCREATE FUNCTION access_private.editor_org_ids() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT org_id FROM public.memberships\n  WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION access_private.shared_record_ids(), access_private.owned_record_ids(), access_private.editor_org_ids() FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION access_private.shared_record_ids(), access_private.owned_record_ids(), access_private.editor_org_ids() TO authenticated;\n\nREVOKE ALL ON public.records, public.shares, public.organizations, public.memberships FROM PUBLIC, anon, authenticated;\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- org_id and owner_id cannot be assigned by UPDATE, including ON CONFLICT.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE POLICY records_read ON public.records FOR SELECT TO authenticated\nUSING (owner_id = (SELECT auth.uid()) OR id IN (SELECT access_private.shared_record_ids()));\nCREATE POLICY records_create ON public.records FOR INSERT TO authenticated\nWITH CHECK (owner_id = (SELECT auth.uid()) AND org_id IN (SELECT access_private.editor_org_ids()));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\nUSING (owner_id = (SELECT auth.uid()))\nWITH CHECK (owner_id = (SELECT auth.uid()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_owner ON public.shares FOR ALL TO authenticated\nUSING (record_id IN (SELECT access_private.owned_record_ids()))\nWITH CHECK (record_id IN (SELECT access_private.owned_record_ids()));\n\nCREATE INDEX records_owner_id_idx ON public.records(owner_id);\nCREATE INDEX shares_user_id_idx ON public.shares(user_id);\nCREATE INDEX memberships_user_id_idx ON public.memberships(user_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "7817e27b609bfc8c07b92b8e1bcbfcec755e216a38164085dac116314404edca",
          "sql": "BEGIN;\n\n-- Keep the existing owner-only share management and record write policies.\n-- STABLE uses the current statement's snapshot, so subsequent statements see\n-- committed revocations without caching authorization across statements.\nCREATE OR REPLACE FUNCTION access_private.shared_record_ids()\nRETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT record_id\n  FROM public.shares\n  WHERE user_id = (SELECT auth.uid()) AND active = true\n$$;\n\n-- CREATE OR REPLACE preserves the restricted EXECUTE grants from 001.sql.\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 233300,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 109005
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "document-sharing-2-codex-skill",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "6bc2e1492be850a4554007cc4a243023cd85d94aacca2435af5d14116eea87b5",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 157442,
          "wholeTreeTokens": 157442,
          "usageComplete": true,
          "actorElapsedMs": 64149,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "0bf4f1967d92f61a2343e26f15ad27880df7dacf13e98092811d0e2185ec54f0",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "b0c30bc146ba505596594e3a48a584da9b8b3ae0381df4a78622512a183bcc95"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 111835,
          "wholeTreeTokens": 111835,
          "usageComplete": true,
          "actorElapsedMs": 52681,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "0f194efa167ec7216eedad649f7410ec56de0f0a33b5714ff78a79f24f30166d",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "9bf0a7397d10a56e47d2e9edd1a8edaaab43db11791a8f1bad554feef0489ac1",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "0bf4f1967d92f61a2343e26f15ad27880df7dacf13e98092811d0e2185ec54f0",
          "sql": "BEGIN;\nCREATE SCHEMA access_private;\nREVOKE ALL ON SCHEMA access_private FROM PUBLIC;\nGRANT USAGE ON SCHEMA access_private TO authenticated;\n\n-- These helpers deliberately use table-owner RLS bypass, not FORCE RLS.\n-- No caller-supplied identity is accepted.\nCREATE FUNCTION access_private.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT record_id FROM public.shares WHERE user_id = (SELECT auth.uid())\n$$;\nCREATE FUNCTION access_private.is_editor(target_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT EXISTS (SELECT 1 FROM public.memberships\n    WHERE org_id = target_org AND user_id = (SELECT auth.uid()) AND access = 'editor')\n$$;\nREVOKE ALL ON FUNCTION access_private.shared_record_ids() FROM PUBLIC, anon;\nREVOKE ALL ON FUNCTION access_private.is_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION access_private.shared_record_ids(), access_private.is_editor(uuid) TO authenticated;\n\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- Existing organization and owner cannot be assigned by client UPDATEs.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\nUSING (owner_id = (SELECT auth.uid()) OR id IN (SELECT access_private.shared_record_ids()));\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\nWITH CHECK (owner_id = (SELECT auth.uid()) AND access_private.is_editor(org_id));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\nUSING (owner_id = (SELECT auth.uid())) WITH CHECK (owner_id = (SELECT auth.uid()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\nUSING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\nWITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\nUSING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())))\nWITH CHECK (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\nUSING (EXISTS (SELECT 1 FROM public.records r WHERE r.id = shares.record_id AND r.owner_id = (SELECT auth.uid())));\nCREATE INDEX records_owner_idx ON public.records(owner_id);\nCREATE INDEX shares_user_record_idx ON public.shares(user_id, record_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "0f194efa167ec7216eedad649f7410ec56de0f0a33b5714ff78a79f24f30166d",
          "sql": "BEGIN;\n\n-- Keep the existing identity-scoped, table-owner lookup, but exclude revoked\n-- shares. STABLE uses the current statement snapshot, not a cached share list.\nCREATE OR REPLACE FUNCTION access_private.shared_record_ids() RETURNS SETOF integer\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT record_id\n  FROM public.shares\n  WHERE user_id = (SELECT auth.uid()) AND active = true\n$$;\n\n-- CREATE OR REPLACE preserves the restricted EXECUTE grants from 001.sql.\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 269277,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 116830
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "public-catalog-1-codex-baseline",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "e201e71836f4eae1c2c40f9294a37c0e311dff01a14d98e0a44c2ad1ee71033c",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 130178,
          "wholeTreeTokens": 130178,
          "usageComplete": true,
          "actorElapsedMs": 43442,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "5473b68a6b0d26acf653b209298b4517ac0115adc7a1853d958aed51c5e8df0d",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1885fabd4a99855dd2fbf3f10aa4e00caefc68fe284fdbc94901af1b16586494"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 102570,
          "wholeTreeTokens": 102570,
          "usageComplete": true,
          "actorElapsedMs": 48786,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "2466d4806bafbe525ad52058b0ed09f646985bd5d295aeb48e629afc738a5002",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "70301b562a354eb3c9c806030296f8595f297af83397561b0189559da615e4f3",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "5473b68a6b0d26acf653b209298b4517ac0115adc7a1853d958aed51c5e8df0d",
          "sql": "BEGIN;\nREVOKE ALL ON public.records, public.organizations, public.memberships, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n-- The table owner can consult membership facts without exposing the table.\nCREATE FUNCTION record_access.editor_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_access.editor_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.editor_orgs() TO authenticated;\n\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\n-- Column grants enforce immutability without comparing against a second read.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_public_read ON public.records FOR SELECT\nTO anon, authenticated USING (true);\nCREATE POLICY records_editor_insert ON public.records FOR INSERT\nTO authenticated WITH CHECK (\n owner_id = (SELECT auth.uid())\n AND org_id IN (SELECT record_access.editor_orgs())\n);\nCREATE POLICY records_editor_update ON public.records FOR UPDATE\nTO authenticated USING (org_id IN (SELECT record_access.editor_orgs()))\nWITH CHECK (org_id IN (SELECT record_access.editor_orgs()));\nCREATE POLICY records_editor_delete ON public.records FOR DELETE\nTO authenticated USING (org_id IN (SELECT record_access.editor_orgs()));\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "2466d4806bafbe525ad52058b0ed09f646985bd5d295aeb48e629afc738a5002",
          "sql": "BEGIN;\n-- Public visibility no longer includes drafts.\nALTER POLICY records_public_read ON public.records\n    USING (published = true);\n\n-- Editors retain access to every record in their organizations, including\n-- drafts owned by another editor. Keep this separate from the anon policy\n-- because only authenticated clients can execute the membership helper.\nCREATE POLICY records_editor_read ON public.records\n    FOR SELECT TO authenticated\n    USING (org_id IN (SELECT record_access.editor_orgs()));\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 232748,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 92228
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "public-catalog-1-codex-skill",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "76a1ed58d9ee5f99fd6ab0bdd0b5c76252bf30e924cfa0d11f6839615167e174",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 159441,
          "wholeTreeTokens": 159441,
          "usageComplete": true,
          "actorElapsedMs": 52466,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "42c35527f992fd2865d578f8dcc988689c5d9b65e611bf6d0c5099e625299796",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "079194ffca8bb5e0af856c539068738d409c4c05dd583841f436c615e545af1f"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 106309,
          "wholeTreeTokens": 106309,
          "usageComplete": true,
          "actorElapsedMs": 46540,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "5c661389476c14b7df5aeb0d17285caf2488e4d865226725e3c73adbb8efe8a8",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "80c8742fc451265b7f740342bca3307f0ed712f73ac86f38ed66465fe382cc31",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "42c35527f992fd2865d578f8dcc988689c5d9b65e611bf6d0c5099e625299796",
          "sql": "BEGIN;\nREVOKE ALL ON public.records, public.organizations, public.memberships, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA access_private;\nREVOKE ALL ON SCHEMA access_private FROM PUBLIC;\nGRANT USAGE ON SCHEMA access_private TO authenticated;\nCREATE FUNCTION access_private.is_editor(target_org uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n SELECT EXISTS (\n   SELECT 1 FROM public.memberships AS m\n   WHERE m.org_id = target_org AND m.user_id = (SELECT auth.uid())\n     AND m.access = 'editor'\n );\n$$;\nREVOKE ALL ON FUNCTION access_private.is_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION access_private.is_editor(uuid) TO authenticated;\n\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\n-- No UPDATE privilege on the immutable organization and owner columns.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_public_read ON public.records FOR SELECT\n TO anon, authenticated USING (true);\nCREATE POLICY records_editor_insert ON public.records FOR INSERT\n TO authenticated WITH CHECK (\n owner_id = (SELECT auth.uid()) AND access_private.is_editor(org_id)\n );\nCREATE POLICY records_editor_update ON public.records FOR UPDATE\n TO authenticated USING (access_private.is_editor(org_id))\n WITH CHECK (access_private.is_editor(org_id));\nCREATE POLICY records_editor_delete ON public.records FOR DELETE\n TO authenticated USING (access_private.is_editor(org_id));\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "5c661389476c14b7df5aeb0d17285caf2488e4d865226725e3c73adbb8efe8a8",
          "sql": "BEGIN;\n\n-- Replace unrestricted catalog reads; do not leave a permissive USING (true).\nALTER POLICY records_public_read ON public.records\n  TO anon, authenticated\n  USING (published = true);\n\n-- Only authenticated editors may also see their organization's drafts.\nCREATE POLICY records_editor_read ON public.records\n  FOR SELECT TO authenticated\n  USING (access_private.is_editor(org_id));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 265750,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 99006
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "public-catalog-1-claude-skill",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "3c2b12b0e66f25d68e37d9d454e4700889ef7cbefd3d1f812441f32333e11f76",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 32,
          "totalChecks": 34
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 32,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function public.records_immutable_cols() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 211845,
          "wholeTreeTokens": 211845,
          "usageComplete": true,
          "actorElapsedMs": 188404,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 16,
          "skillReadCommandObserved": true,
          "migrationSha256": "05ad433fdf1bedc8269befa9805490f492ba316124bf3bff1d19dd2ec96ac5d2",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "8b489ff07584f40009bac027546f772993cd621d7998cc5d75a19e13256fdac3"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 151714,
          "wholeTreeTokens": 151714,
          "usageComplete": true,
          "actorElapsedMs": 72282,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 19,
          "skillReadCommandObserved": true,
          "migrationSha256": "c738dbe0b439d3e11e436c293c7ca7a6c192ad663fa3a0038a144eed14666dae",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "be8dea3bbf11b1d922513f6f4c768a333c9b30ebbcd87f3c643002984f4aee0b",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "05ad433fdf1bedc8269befa9805490f492ba316124bf3bff1d19dd2ec96ac5d2",
          "sql": "-- Enable RLS on all tables (deny-all default for unprivileged roles)\nALTER TABLE public.records      ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships  ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares       ENABLE ROW LEVEL SECURITY;\n\n-- Private schema for security-definer helpers (not exposed to clients)\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\n\n-- Helper: is the calling user an editor of the given org?\n-- SECURITY DEFINER so it can read memberships without granting that privilege to clients.\nCREATE OR REPLACE FUNCTION private.is_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access  = 'editor'\n  );\n$$;\n-- Revoke public default, then grant only to authenticated\nREVOKE EXECUTE ON FUNCTION private.is_editor(uuid) FROM PUBLIC;\nGRANT  EXECUTE ON FUNCTION private.is_editor(uuid) TO authenticated;\n\n-- Grants: records is the public catalog; shares must stay inaccessible\nGRANT SELECT                   ON public.records TO anon, authenticated;\nGRANT INSERT, UPDATE, DELETE   ON public.records TO authenticated;\n-- No grants on organizations, memberships, or shares for client roles\n\n-- Index for RLS write-path lookups (org_id appears in all write policies)\nCREATE INDEX IF NOT EXISTS records_org_id_idx ON public.records (org_id);\n\n-- \u2500\u2500 RLS policies for records \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- Public read: every role (anon + authenticated) sees all catalog rows\nCREATE POLICY records_select ON public.records\n  FOR SELECT\n  USING (true);\n\n-- Editors insert their own records (owner_id must match caller's identity)\nCREATE POLICY records_insert ON public.records\n  FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    private.is_editor(org_id)\n    AND owner_id = (SELECT auth.uid())\n  );\n\n-- Editors update only records in their own org\nCREATE POLICY records_update ON public.records\n  FOR UPDATE\n  TO authenticated\n  USING       (private.is_editor(org_id))\n  WITH CHECK  (private.is_editor(org_id));\n\n-- Editors delete only records in their own org\nCREATE POLICY records_delete ON public.records\n  FOR DELETE\n  TO authenticated\n  USING (private.is_editor(org_id));\n\n-- \u2500\u2500 Immutability trigger: org_id and owner_id must never change \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCREATE OR REPLACE FUNCTION public.records_immutable_cols()\nRETURNS trigger\nLANGUAGE plpgsql\nSECURITY INVOKER\nSET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id    IS DISTINCT FROM OLD.org_id\n  OR NEW.owner_id  IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_cols_trigger\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION public.records_immutable_cols();\n"
        },
        {
          "stage": 2,
          "sha256": "c738dbe0b439d3e11e436c293c7ca7a6c192ad663fa3a0038a144eed14666dae",
          "sql": "-- Drop the old unrestricted read policy\nDROP POLICY records_select ON public.records;\n\n-- anon: published records only\nCREATE POLICY records_select_anon ON public.records\n  FOR SELECT\n  TO anon\n  USING (published = true);\n\n-- authenticated: published records for everyone, plus all records in own org for editors\nCREATE POLICY records_select_auth ON public.records\n  FOR SELECT\n  TO authenticated\n  USING (\n    published = true\n    OR private.is_editor(org_id)\n  );\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 363559,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 260686
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "public-catalog-1-claude-baseline",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "73c0ba5196d8cae798e7a0d629b1e155b1b4b4fa910a2238ff11749917aa592a",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 236229,
          "wholeTreeTokens": 236229,
          "usageComplete": true,
          "actorElapsedMs": 181721,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 11,
          "skillReadCommandObserved": false,
          "migrationSha256": "ca1856407313febaf81e5335d2fbde5a549a2fb4c10ef6c13dd0db8ad5955831",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "2af065bec395e16ab6946d9012768f042635996369ec936c3bf30dc0171d52b4"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 158512,
          "wholeTreeTokens": 158512,
          "usageComplete": true,
          "actorElapsedMs": 109674,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "b701996280bcb93ce27d97dc3504c71a6f259619a23cc7d16048691d7874466a",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "a3d501ad3bd125a2afd53b389956b3892e2a25637f3c5c4dc57793174ad21688",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "ca1856407313febaf81e5335d2fbde5a549a2fb4c10ef6c13dd0db8ad5955831",
          "sql": "-- Private schema for security-definer helpers (avoids recursive RLS and grant exposure)\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Returns true if the current user is an editor member of the given org.\n-- Runs as migrator (table owner) so it reads memberships without needing a client grant.\nCREATE FUNCTION private.is_editor_of(p_org_id uuid)\n  RETURNS boolean\n  LANGUAGE sql SECURITY DEFINER\n  SET search_path = ''\n  STABLE\nAS $$\n  SELECT EXISTS(\n    SELECT 1 FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access  = 'editor'\n  )\n$$;\n\n-- Returns the stored org_id and owner_id for a record.\n-- Runs as migrator (table owner, FORCE RLS not set) so it bypasses RLS and always sees\n-- the committed row \u2014 used in UPDATE WITH CHECK to enforce column immutability.\nCREATE FUNCTION private.record_immutable_cols(\n  p_id      integer,\n  OUT p_org_id   uuid,\n  OUT p_owner_id uuid\n)\n  RETURNS record\n  LANGUAGE sql SECURITY DEFINER\n  SET search_path = ''\n  STABLE\nAS $$\n  SELECT org_id, owner_id FROM public.records WHERE id = p_id\n$$;\n\n-- Restrict direct invocation: only authenticated needs these at runtime\nREVOKE EXECUTE ON FUNCTION private.is_editor_of(uuid)             FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION private.record_immutable_cols(integer) FROM PUBLIC;\nGRANT USAGE    ON SCHEMA  private                    TO authenticated;\nGRANT EXECUTE  ON FUNCTION private.is_editor_of(uuid)             TO authenticated;\nGRANT EXECUTE  ON FUNCTION private.record_immutable_cols(integer) TO authenticated;\n\n-- Index so the membership lookup in is_editor_of() uses an index scan on user_id.\n-- The PK is (org_id, user_id) so user_id has no leading index without this.\nCREATE INDEX memberships_user_id_idx\n  ON public.memberships USING btree (user_id);\n\n-- \u2500\u2500 TABLE GRANTS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n-- organizations: no client access needed (records API is the public surface)\nREVOKE ALL ON TABLE public.organizations FROM anon, authenticated;\n\n-- memberships: only read via security-definer helper, never directly by clients\nREVOKE ALL ON TABLE public.memberships FROM anon, authenticated;\n\n-- records: everyone reads; only authenticated may attempt writes (RLS restricts further)\nREVOKE ALL ON TABLE public.records FROM anon, authenticated;\nGRANT SELECT            ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, UPDATE, DELETE ON TABLE public.records TO authenticated;\n\n-- shares: no client access at all\nREVOKE ALL ON TABLE public.shares FROM anon, authenticated;\n\n-- \u2500\u2500 ROW LEVEL SECURITY \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares  ENABLE ROW LEVEL SECURITY;\n\n-- SELECT: all catalog records are public regardless of published\nCREATE POLICY \"records_select\"\n  ON public.records FOR SELECT\n  TO anon, authenticated\n  USING (true);\n\n-- INSERT: caller must be an editor of the target org; owner_id must equal their identity\nCREATE POLICY \"records_insert\"\n  ON public.records FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    (SELECT auth.uid()) IS NOT NULL\n    AND owner_id = (SELECT auth.uid())\n    AND private.is_editor_of(org_id)\n  );\n\n-- UPDATE: caller must be an editor of the org; org_id and owner_id must stay unchanged\nCREATE POLICY \"records_update\"\n  ON public.records FOR UPDATE\n  TO authenticated\n  USING (\n    private.is_editor_of(org_id)\n  )\n  WITH CHECK (\n    private.is_editor_of(org_id)\n    AND org_id   = (SELECT p_org_id   FROM private.record_immutable_cols(id))\n    AND owner_id = (SELECT p_owner_id FROM private.record_immutable_cols(id))\n  );\n\n-- DELETE: caller must be an editor of the owning org\nCREATE POLICY \"records_delete\"\n  ON public.records FOR DELETE\n  TO authenticated\n  USING (\n    private.is_editor_of(org_id)\n  );\n"
        },
        {
          "stage": 2,
          "sha256": "b701996280bcb93ce27d97dc3504c71a6f259619a23cc7d16048691d7874466a",
          "sql": "-- Tighten SELECT: unpublished records are private drafts.\n-- anon and authenticated have separate policies so anon never needs the\n-- security-definer helper (which is only granted to authenticated).\n\nDROP POLICY \"records_select\" ON public.records;\n\n-- anon: published rows only, no helper needed\nCREATE POLICY \"records_select_anon\"\n  ON public.records FOR SELECT\n  TO anon\n  USING (published = true);\n\n-- authenticated: published rows are always visible; editors also see all\n-- records belonging to their own organization (including drafts)\nCREATE POLICY \"records_select_authenticated\"\n  ON public.records FOR SELECT\n  TO authenticated\n  USING (\n    published = true\n    OR private.is_editor_of(org_id)\n  );\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 394741,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 291395
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-2-claude-baseline",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "6f523edcb1f0889083215dcbae891cb4f1b8994f58382f99a11132b68097f508",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_immutable_cols() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 99578,
          "wholeTreeTokens": 99578,
          "usageComplete": true,
          "actorElapsedMs": 90936,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 9,
          "skillReadCommandObserved": false,
          "migrationSha256": "b61506c1ee11d3869d3b4dbfc409a46a10a9274e83a025f099aee95bef1748be",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "bbc7b550863ab77d93154eaaecf9559ecdcbfa875ae911c83df6dfa2adbe428d"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 64121,
          "wholeTreeTokens": 64121,
          "usageComplete": true,
          "actorElapsedMs": 38981,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 8,
          "skillReadCommandObserved": false,
          "migrationSha256": "fd434cd07ee0b15d58126877329304c0f6b8fadc481c11bdbe6fcc911dbd6557",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "196a6c01c48922bcf4d0668f5931becfe909dd54e27e4448a1b96f26979e8752",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "b61506c1ee11d3869d3b4dbfc409a46a10a9274e83a025f099aee95bef1748be",
          "sql": "-- Grant SELECT on memberships to authenticated so RLS subqueries can evaluate membership\nGRANT SELECT ON public.memberships TO authenticated;\n\n-- Grant DML on records to authenticated; RLS will restrict access\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records TO authenticated;\n\n-- Enable RLS on records (FORCE ensures even the table owner is subject to it)\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records FORCE ROW LEVEL SECURITY;\n\n-- Trigger function to prevent clients from changing org_id or owner_id\nCREATE FUNCTION public.records_immutable_cols()\nRETURNS trigger LANGUAGE plpgsql SECURITY DEFINER AS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_cols_tg\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION public.records_immutable_cols();\n\n-- SELECT: authenticated user must be an editor in the record's org\nCREATE POLICY records_select ON public.records\n  FOR SELECT TO authenticated\n  USING (\n    EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access = 'editor'\n    )\n  );\n\n-- INSERT: user must be editor in the target org, and must be the owner\nCREATE POLICY records_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = auth.uid()\n    AND EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access = 'editor'\n    )\n  );\n\n-- UPDATE: user must be editor in the row's org (USING = old row filter, WITH CHECK = new row filter)\nCREATE POLICY records_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (\n    EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access = 'editor'\n    )\n  )\n  WITH CHECK (\n    EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access = 'editor'\n    )\n  );\n\n-- DELETE: user must be editor in the record's org\nCREATE POLICY records_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (\n    EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access = 'editor'\n    )\n  );\n\n-- Enable RLS on shares with no permissive policies \u2192 deny all client access\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares FORCE ROW LEVEL SECURITY;\n"
        },
        {
          "stage": 2,
          "sha256": "fd434cd07ee0b15d58126877329304c0f6b8fadc481c11bdbe6fcc911dbd6557",
          "sql": "-- Expand SELECT access: viewers may now read their organization's records.\n-- All other policies (INSERT/UPDATE/DELETE = editor only) are unchanged.\n\nDROP POLICY records_select ON public.records;\n\nCREATE POLICY records_select ON public.records\n  FOR SELECT TO authenticated\n  USING (\n    EXISTS (\n      SELECT 1 FROM public.memberships m\n      WHERE m.org_id = records.org_id\n        AND m.user_id = auth.uid()\n        AND m.access IN ('editor', 'viewer')\n    )\n  );\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 163699,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 129917
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-2-claude-skill",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "4a493678998007ee3cce3a7cc118216387d197f2ff516bba41ef9a81bfb302d7",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function private.records_immutable_ids() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 366055,
          "wholeTreeTokens": 366055,
          "usageComplete": true,
          "actorElapsedMs": 240374,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 19,
          "skillReadCommandObserved": true,
          "migrationSha256": "a2daa4e4276288a6da1a0375da06d522b26008ce058fbf584a15576dae98fc7e",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "a7a459dc9a1fa618f0eeb7c2a6a63702e826645d92934a7f115359b98cf4a193"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 92078,
          "wholeTreeTokens": 92078,
          "usageComplete": true,
          "actorElapsedMs": 52742,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 9,
          "skillReadCommandObserved": true,
          "migrationSha256": "d303e2e4e18f08073896c74c857590eb6afd618b910a37e44308c84aba6392f5",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "cf539961484b9ac3d3f5dae36742ff9bd3ec16aa7d929feabf8996c61dc7a9ec",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "a2daa4e4276288a6da1a0375da06d522b26008ce058fbf584a15576dae98fc7e",
          "sql": "-- Private schema for internal helper functions not directly callable by clients\nCREATE SCHEMA private;\n\n-- Check whether the current JWT user is an editor of the given org.\n-- SECURITY DEFINER: runs with migrator's privileges so authenticated\n-- does not need (and is not granted) SELECT on memberships directly.\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  );\n$$;\n\n-- authenticated must be able to call this function so RLS policies work.\n-- The SECURITY DEFINER body handles access to memberships internally.\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Grant DML on records to the application role only.\n-- anon gets nothing; shares gets nothing.\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records TO authenticated;\n\n-- Enable and force RLS on records (force applies even to the table owner).\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records FORCE ROW LEVEL SECURITY;\n\n-- Enable RLS on shares with no permissive policies \u2192 deny-all for every role.\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares FORCE ROW LEVEL SECURITY;\n\n-- SELECT: authenticated user must be an editor of the record's org.\nCREATE POLICY records_select ON public.records\n  FOR SELECT\n  TO authenticated\n  USING (private.is_org_editor(org_id));\n\n-- INSERT: editor only, and owner_id must equal the caller's identity.\nCREATE POLICY records_insert ON public.records\n  FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND private.is_org_editor(org_id)\n  );\n\n-- UPDATE: caller must be an editor both before and after (org_id unchanged\n-- because the trigger below blocks any change to org_id/owner_id).\nCREATE POLICY records_update ON public.records\n  FOR UPDATE\n  TO authenticated\n  USING  (private.is_org_editor(org_id))\n  WITH CHECK (private.is_org_editor(org_id));\n\n-- DELETE: editor of the record's org.\nCREATE POLICY records_delete ON public.records\n  FOR DELETE\n  TO authenticated\n  USING (private.is_org_editor(org_id));\n\n-- Enforce immutability of org_id and owner_id at the row level.\n-- A BEFORE trigger fires before RLS WITH CHECK, so any attempt to change\n-- these columns raises an exception regardless of RLS outcome.\nCREATE OR REPLACE FUNCTION private.records_immutable_ids()\nRETURNS trigger\nLANGUAGE plpgsql\nAS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id OR\n     NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_ids\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW\n  EXECUTE FUNCTION private.records_immutable_ids();\n\n-- Index supporting RLS membership lookups from record rows.\nCREATE INDEX records_org_id_idx ON public.records (org_id);\n"
        },
        {
          "stage": 2,
          "sha256": "d303e2e4e18f08073896c74c857590eb6afd618b910a37e44308c84aba6392f5",
          "sql": "-- Allow viewer members (and editors) to SELECT records in their org.\n-- All other policies (INSERT/UPDATE/DELETE require editor) are unchanged.\n\nCREATE OR REPLACE FUNCTION private.is_org_member(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access IN ('editor', 'viewer')\n  );\n$$;\n\nGRANT EXECUTE ON FUNCTION private.is_org_member(uuid) TO authenticated;\n\nDROP POLICY records_select ON public.records;\n\nCREATE POLICY records_select ON public.records\n  FOR SELECT\n  TO authenticated\n  USING (private.is_org_member(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 458133,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 293116
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-2-codex-baseline",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "6ce359b1ca64303aa4b12d016adb32f556a23aaeaa9be5accf60f2998428376d",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 127959,
          "wholeTreeTokens": 127959,
          "usageComplete": true,
          "actorElapsedMs": 48869,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "e51428695c5e5344072bbef49aa564d13b586ba8184e74df02cad3efb0dc19a5",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "59f974f43f177ffb0d7e0587bc431925af34e1c95e8ef43dfe84feeb30f69358"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 130129,
          "wholeTreeTokens": 130129,
          "usageComplete": true,
          "actorElapsedMs": 50313,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "44eea4dbe02942777a0a8e7cbd3a4af71d3cb603571bc3bc5970bd9922e42ac4",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "0a05c7dd4b00eceda3655b3a35170615b73e9d3470bb7c0df103dad4bdddeafe",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "e51428695c5e5344072bbef49aa564d13b586ba8184e74df02cad3efb0dc19a5",
          "sql": "BEGIN;\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n-- The owner reads memberships without exposing the table to clients.\nCREATE FUNCTION record_access.editor_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_access.editor_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.editor_orgs() TO authenticated;\nCREATE INDEX memberships_user_id_idx ON public.memberships(user_id);\nCREATE INDEX records_org_id_idx ON public.records(org_id);\n\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- No table-level UPDATE grant: organization and owner cannot be assigned.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()));\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (org_id IN (SELECT record_access.editor_orgs()) AND owner_id = (SELECT auth.uid()));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()))\n WITH CHECK (org_id IN (SELECT record_access.editor_orgs()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()));\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "44eea4dbe02942777a0a8e7cbd3a4af71d3cb603571bc3bc5970bd9922e42ac4",
          "sql": "BEGIN;\n-- Broaden reads only; editor_orgs() remains the gate for every write.\nCREATE FUNCTION record_access.readable_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid())\n   AND m.access IN ('editor', 'viewer')\n$$;\nREVOKE ALL ON FUNCTION record_access.readable_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.readable_orgs() TO authenticated;\n\nALTER POLICY records_select ON public.records TO authenticated\n USING (org_id IN (SELECT record_access.readable_orgs()));\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 258088,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 99182
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-2-codex-skill",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "3a95b2c8470f1838d2b9fc4fd4b8c61f618219b71367d73b9282f107c3d9a71e",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 177870,
          "wholeTreeTokens": 177870,
          "usageComplete": true,
          "actorElapsedMs": 61389,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "5e93ede334195989513db397176bf67245cd24bafcde62a599652b651260eebc",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "a2181bc914867792ff977788344d4a24b8a44bb4d042d8c0831a2c8ff9831d68"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 156419,
          "wholeTreeTokens": 156419,
          "usageComplete": true,
          "actorElapsedMs": 56560,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "7c25016a2e7102187cacd8cb8e82de869b62d6013a87a62249a0639ad643170d",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "ba459a0ad11bccb192099f80024a2a231cdb41b201bac11883ded41ea1dba822",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "5e93ede334195989513db397176bf67245cd24bafcde62a599652b651260eebc",
          "sql": "BEGIN;\n\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n FROM PUBLIC, anon, authenticated;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n\n-- The table owner can read memberships without exposing them to clients.\n-- Do not FORCE RLS on memberships: this helper relies on owner access.\nCREATE FUNCTION record_access.editor_org_ids()\nRETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_access.editor_org_ids() FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION record_access.editor_org_ids() TO authenticated;\n\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- Column privileges enforce immutability independently of row policies.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\n\nCREATE POLICY records_editor_select ON public.records FOR SELECT TO authenticated\n USING (org_id IN (SELECT record_access.editor_org_ids()));\nCREATE POLICY records_editor_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (org_id IN (SELECT record_access.editor_org_ids())\n             AND owner_id = (SELECT auth.uid()));\nCREATE POLICY records_editor_update ON public.records FOR UPDATE TO authenticated\n USING (org_id IN (SELECT record_access.editor_org_ids()))\n WITH CHECK (org_id IN (SELECT record_access.editor_org_ids()));\nCREATE POLICY records_editor_delete ON public.records FOR DELETE TO authenticated\n USING (org_id IN (SELECT record_access.editor_org_ids()));\n\nCREATE INDEX memberships_editor_user_org_idx ON public.memberships (user_id, org_id)\n WHERE access = 'editor';\nCREATE INDEX records_org_id_idx ON public.records (org_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "7c25016a2e7102187cacd8cb8e82de869b62d6013a87a62249a0639ad643170d",
          "sql": "BEGIN;\n\n-- Keep the editor helper and write policies unchanged. This helper authorizes\n-- only the additional read access for viewer memberships.\nCREATE FUNCTION record_access.viewer_org_ids()\nRETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'viewer'\n$$;\nREVOKE ALL ON FUNCTION record_access.viewer_org_ids() FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION record_access.viewer_org_ids() TO authenticated;\n\nCREATE POLICY records_viewer_select ON public.records\n FOR SELECT TO authenticated\n USING (org_id IN (SELECT record_access.viewer_org_ids()));\n\nCREATE INDEX memberships_viewer_user_org_idx\n ON public.memberships (user_id, org_id) WHERE access = 'viewer';\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 334289,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 117949
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-1-claude-baseline",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "cbca08330b6f9c95b35b6e18088a6cd8aa38fe00bf39f921340816e9352c5804",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": false,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        },
        {
          "passed": false,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": false,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  P0001: org_id and owner_id are immutable\nCONTEXT:  PL/pgSQL function records_guard_immutable() line 5 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [
        {
          "stage": 1,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 1,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot move existing record to another tenant",
          "originalPassed": false,
          "sensitivityPassed": true
        },
        {
          "stage": 2,
          "check": "cannot reassign existing owner",
          "originalPassed": false,
          "sensitivityPassed": true
        }
      ],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 148254,
          "wholeTreeTokens": 148254,
          "usageComplete": true,
          "actorElapsedMs": 135003,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 11,
          "skillReadCommandObserved": false,
          "migrationSha256": "ed04826a85cc37b0d274dd56849bd902fe34f28e08ce89870ac6f98da3e7b4b8",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "87d3f88650339dc1f1892b6cae8caeb1ac69c4f670a6ace71b6498af6f6610fa"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 85657,
          "wholeTreeTokens": 85657,
          "usageComplete": true,
          "actorElapsedMs": 60047,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 9,
          "skillReadCommandObserved": false,
          "migrationSha256": "6f7caf183268761ac60f119fa87d6a03e5a40b3cab0385c285fa41c5c9de083b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "98bd452a0e4009b58157c1555470dfcc4f4b12d4135820e8df45b98f2817d90f",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "ed04826a85cc37b0d274dd56849bd902fe34f28e08ce89870ac6f98da3e7b4b8",
          "sql": "-- Grant DML on records only to authenticated; anon and authenticated get nothing on shares\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records TO authenticated;\nREVOKE ALL ON public.shares FROM anon, authenticated;\n\n-- Security-definer helper so RLS policies can read memberships without granting\n-- authenticated direct access to that table\nCREATE OR REPLACE FUNCTION public.is_editor_of(p_org_id uuid)\n  RETURNS boolean\n  LANGUAGE sql\n  STABLE\n  SECURITY DEFINER\n  SET search_path = public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = auth.uid()\n      AND access  = 'editor'\n  );\n$$;\nREVOKE EXECUTE ON FUNCTION public.is_editor_of(uuid) FROM PUBLIC;\nGRANT  EXECUTE ON FUNCTION public.is_editor_of(uuid) TO authenticated;\n\n-- Trigger to make org_id and owner_id immutable on UPDATE\nCREATE OR REPLACE FUNCTION public.records_guard_immutable()\n  RETURNS trigger LANGUAGE plpgsql AS $$\nBEGIN\n  IF NEW.org_id    IS DISTINCT FROM OLD.org_id OR\n     NEW.owner_id  IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'org_id and owner_id are immutable';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nCREATE TRIGGER records_immutable_tg\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION public.records_guard_immutable();\n\n-- RLS on records\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\n\nCREATE POLICY records_select ON public.records\n  FOR SELECT TO authenticated\n  USING (public.is_editor_of(org_id));\n\nCREATE POLICY records_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (public.is_editor_of(org_id) AND owner_id = auth.uid());\n\nCREATE POLICY records_update ON public.records\n  FOR UPDATE TO authenticated\n  USING      (public.is_editor_of(org_id))\n  WITH CHECK (public.is_editor_of(org_id));\n\nCREATE POLICY records_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (public.is_editor_of(org_id));\n\n-- RLS on shares: enable with zero permissive policies \u2192 deny all clients\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n"
        },
        {
          "stage": 2,
          "sha256": "6f7caf183268761ac60f119fa87d6a03e5a40b3cab0385c285fa41c5c9de083b",
          "sql": "-- Add a helper that returns true for any membership (editor or viewer)\nCREATE OR REPLACE FUNCTION public.is_member_of(p_org_id uuid)\n  RETURNS boolean\n  LANGUAGE sql\n  STABLE\n  SECURITY DEFINER\n  SET search_path = public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id  = p_org_id\n      AND user_id = auth.uid()\n  );\n$$;\nREVOKE EXECUTE ON FUNCTION public.is_member_of(uuid) FROM PUBLIC;\nGRANT  EXECUTE ON FUNCTION public.is_member_of(uuid) TO authenticated;\n\n-- Replace SELECT policy: editors and viewers may SELECT their org's records\nDROP POLICY records_select ON public.records;\nCREATE POLICY records_select ON public.records\n  FOR SELECT TO authenticated\n  USING (public.is_member_of(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 233911,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 195050
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-1-claude-skill",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-sonnet-4-6",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "1bdb8a3389ea6fe25073cd6a98ccd8d086fe2ed46f766629f16b6f7f6e04f42e",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 214146,
          "wholeTreeTokens": 214146,
          "usageComplete": true,
          "actorElapsedMs": 209920,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 15,
          "skillReadCommandObserved": true,
          "migrationSha256": "91b52dcffc30b6234cf78898af12fde1860c9e8ab55075ca5170a75af70410b5",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "f4c403daacbf4f15e54a71acb0f8ff305234f0b89cff9916cfd6941d55f7d66f"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 198329,
          "wholeTreeTokens": 198329,
          "usageComplete": true,
          "actorElapsedMs": 203832,
          "observedModel": "claude-sonnet-4-6",
          "toolCommands": 13,
          "skillReadCommandObserved": true,
          "migrationSha256": "f09cd1c824682d7f820007da69d4cb4fb832a4a1b0167fa23cc4263eb570c16b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "999f8e1d701de3bbb6a7392d9fbcab1a746a18ac3e28c6142c442a79f2caea52",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "91b52dcffc30b6234cf78898af12fde1860c9e8ab55075ca5170a75af70410b5",
          "sql": "-- Private schema for security-definer helpers (not exposed to clients)\nCREATE SCHEMA IF NOT EXISTS private;\n\n-- Checks whether the current authenticated user is an editor of the given org.\n-- SECURITY DEFINER so memberships can be read without granting SELECT to clients.\nCREATE OR REPLACE FUNCTION private.is_editor_of(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSECURITY DEFINER\nSTABLE\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n      AND access = 'editor'\n  );\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_editor_of(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_editor_of(uuid) TO authenticated;\n\n-- Verifies proposed org_id and owner_id match what is currently stored,\n-- preventing clients from mutating those immutable columns via UPDATE.\nCREATE OR REPLACE FUNCTION private.record_fields_unchanged(p_id integer, p_org_id uuid, p_owner_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSECURITY DEFINER\nSTABLE\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records\n    WHERE id = p_id AND org_id = p_org_id AND owner_id = p_owner_id\n  );\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.record_fields_unchanged(integer, uuid, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.record_fields_unchanged(integer, uuid, uuid) TO authenticated;\n\n-- Only authenticated users get DML on records; anon gets nothing\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records TO authenticated;\n\n-- Enable RLS; non-owner roles (authenticated, anon) are always subject to it\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\n\n-- Enable RLS on shares with no permissive policies \u2192 deny all client access\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- SELECT: editors of the record's org only\nCREATE POLICY records_select ON public.records\n  FOR SELECT\n  TO authenticated\n  USING ((SELECT private.is_editor_of(org_id)));\n\n-- INSERT: editors only; owner_id must equal the caller's identity\nCREATE POLICY records_insert ON public.records\n  FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    (SELECT private.is_editor_of(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\n-- UPDATE: editors only; org_id and owner_id must stay unchanged\nCREATE POLICY records_update ON public.records\n  FOR UPDATE\n  TO authenticated\n  USING ((SELECT private.is_editor_of(org_id)))\n  WITH CHECK (\n    (SELECT private.is_editor_of(org_id))\n    AND (SELECT private.record_fields_unchanged(id, org_id, owner_id))\n  );\n\n-- DELETE: editors of the record's org only\nCREATE POLICY records_delete ON public.records\n  FOR DELETE\n  TO authenticated\n  USING ((SELECT private.is_editor_of(org_id)));\n\n-- Index to keep membership lookups fast under RLS\nCREATE INDEX IF NOT EXISTS memberships_org_user_access_idx\n  ON public.memberships (org_id, user_id, access);\n"
        },
        {
          "stage": 2,
          "sha256": "f09cd1c824682d7f820007da69d4cb4fb832a4a1b0167fa23cc4263eb570c16b",
          "sql": "-- Helper: true when the caller is any member (editor or viewer) of the given org.\nCREATE OR REPLACE FUNCTION private.is_member_of(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSECURITY DEFINER\nSTABLE\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships\n    WHERE org_id = p_org_id\n      AND user_id = (SELECT auth.uid())\n  );\n$$;\n\nREVOKE EXECUTE ON FUNCTION private.is_member_of(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_member_of(uuid) TO authenticated;\n\n-- Replace the editor-only SELECT policy with one that also permits viewers.\nDROP POLICY records_select ON public.records;\n\nCREATE POLICY records_select ON public.records\n  FOR SELECT\n  TO authenticated\n  USING ((SELECT private.is_member_of(org_id)));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 412475,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 413752
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-1-codex-skill",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "619a3d37db1157cab30d8dd1161ad9a43475c231e525a0f75d98914d4b5d2481",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 161527,
          "wholeTreeTokens": 161527,
          "usageComplete": true,
          "actorElapsedMs": 58281,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "20e8d36cdeacadd81725e22c1bc347b90e482660e69136e9c0c165121297ecce",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "67b0cc31531d674c7c2666646bb2b557c3056401be6c1deab6406674a8726ead"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 99744,
          "wholeTreeTokens": 99744,
          "usageComplete": true,
          "actorElapsedMs": 50157,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "245d08611113ce8d66b1c54abae21c6edafd3fd45646659a09d422f03707d63b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "d8d3f4d6187cf8b4f36376e4aaee1012a6171360f35bbe407026ef9df6b4ce46",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "20e8d36cdeacadd81725e22c1bc347b90e482660e69136e9c0c165121297ecce",
          "sql": "BEGIN;\n\nREVOKE ALL ON TABLE public.organizations, public.memberships,\n  public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Only the caller's own editor membership is needed for authorization.\nGRANT SELECT ON public.memberships TO authenticated;\nCREATE POLICY memberships_editor_self ON public.memberships\n  FOR SELECT TO authenticated\n  USING (user_id = (SELECT auth.uid()) AND access = 'editor');\n\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- No table-level UPDATE grant: organization and owner remain immutable.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING (org_id IN (\n    SELECT org_id FROM public.memberships\n    WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n  ));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND org_id IN (\n      SELECT org_id FROM public.memberships\n      WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n    )\n  );\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (org_id IN (\n    SELECT org_id FROM public.memberships\n    WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n  ))\n  WITH CHECK (org_id IN (\n    SELECT org_id FROM public.memberships\n    WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n  ));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (org_id IN (\n    SELECT org_id FROM public.memberships\n    WHERE user_id = (SELECT auth.uid()) AND access = 'editor'\n  ));\n\nCREATE INDEX memberships_user_editor_idx ON public.memberships (user_id, org_id)\n  WHERE access = 'editor';\nCREATE INDEX records_org_id_idx ON public.records (org_id);\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "245d08611113ce8d66b1c54abae21c6edafd3fd45646659a09d422f03707d63b",
          "sql": "BEGIN;\n\n-- Expose only the caller's own viewer membership for the read-policy lookup.\nCREATE POLICY memberships_viewer_self ON public.memberships\n  FOR SELECT TO authenticated\n  USING (user_id = (SELECT auth.uid()) AND access = 'viewer');\n\n-- Add read access only; editor write checks still explicitly require 'editor'.\nCREATE POLICY records_viewer_select ON public.records\n  FOR SELECT TO authenticated\n  USING (org_id IN (\n    SELECT org_id FROM public.memberships\n    WHERE user_id = (SELECT auth.uid()) AND access = 'viewer'\n  ));\n\nCREATE INDEX memberships_user_viewer_idx ON public.memberships (user_id, org_id)\n  WHERE access = 'viewer';\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 261271,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 108438
    },
    {
      "phase": "continuation-uncapped-01",
      "id": "tenant-records-1-codex-baseline",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6.1-sol",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "bdc8b4be92586d4a952e90231286bfd37a61f33fa6b234ecd1b0bce21ca1ca2a",
      "protocolHash": "2fe7a6ec99ca078794a66d5b85d8578ee03b3a3ab356d917f5e76bb0057c89fe",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 127734,
          "wholeTreeTokens": 127734,
          "usageComplete": true,
          "actorElapsedMs": 46374,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "5b98a4ec339549fbc5310aa72decb824e01455cae34d979e59e6c88e04f816da",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "115704c796b41dcd35a388bc407296288cbef9883b42aeb3b2c9f60295181d30"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 95714,
          "wholeTreeTokens": 95714,
          "usageComplete": true,
          "actorElapsedMs": 40314,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "dc51894f3ecad492366bb6e6ecf79a061d7f0994256b82766dc39ef0dd1e2d47",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "d5dac1a76c5bcf9866344a0c944106afd3619b4e02e372deada66b3c81391ab5",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "5b98a4ec339549fbc5310aa72decb824e01455cae34d979e59e6c88e04f816da",
          "sql": "BEGIN;\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCREATE SCHEMA record_access;\nREVOKE ALL ON SCHEMA record_access FROM PUBLIC;\nGRANT USAGE ON SCHEMA record_access TO authenticated;\n-- The table owner can inspect memberships without exposing that table to clients.\nCREATE FUNCTION record_access.editor_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n$$;\nREVOKE ALL ON FUNCTION record_access.editor_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.editor_orgs() TO authenticated;\n\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- No table-wide UPDATE grant: these two identity columns remain immutable.\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()));\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n WITH CHECK (org_id IN (SELECT record_access.editor_orgs()) AND owner_id = (SELECT auth.uid()));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()))\n WITH CHECK (org_id IN (SELECT record_access.editor_orgs()));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n USING (org_id IN (SELECT record_access.editor_orgs()));\nCREATE INDEX records_org_id_idx ON public.records (org_id);\nCREATE INDEX memberships_user_id_idx ON public.memberships (user_id);\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "dc51894f3ecad492366bb6e6ecf79a061d7f0994256b82766dc39ef0dd1e2d47",
          "sql": "BEGIN;\n\n-- Read membership is broader than write membership; keep editor_orgs unchanged.\nCREATE FUNCTION record_access.reader_orgs() RETURNS SETOF uuid\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n SELECT m.org_id FROM public.memberships AS m\n WHERE m.user_id = (SELECT auth.uid()) AND m.access IN ('editor', 'viewer')\n$$;\nREVOKE ALL ON FUNCTION record_access.reader_orgs() FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION record_access.reader_orgs() TO authenticated;\n\nALTER POLICY records_select ON public.records\n USING (org_id IN (SELECT record_access.reader_orgs()));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 223448,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 86688
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-2-claude-skill",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "1059a7d82eefe8148dfef7db562df9cb7f2a2209cee6e576f8a5ccfe35435f66",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 287029,
          "wholeTreeTokens": 287029,
          "usageComplete": true,
          "actorElapsedMs": 88762,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": true,
          "migrationSha256": "4c59ff6ed8abb1aceea4241ecfc5dcbfca4cbb47ce31099b8d591164c45d19e0",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "753d9d9838ec24e9ea7c3d56766383ef96c6a35f4f4418f86f7ca94c6bdc61f0"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 105185,
          "wholeTreeTokens": 105185,
          "usageComplete": true,
          "actorElapsedMs": 33754,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "522c1eb02283ce6e5db791e50d8c55987f200f065cdc27b15f253729ed0bf934",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "79d4054cbcb7bb2947814bef9c6c912bc0c357b93c02046e221f0ce7d6f7b182",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "4c59ff6ed8abb1aceea4241ecfc5dcbfca4cbb47ce31099b8d591164c45d19e0",
          "sql": "-- 001: client access rules (anon / authenticated) for organizations,\n-- memberships, records and shares. Runs as migrator (table owner, NOBYPASSRLS).\n--\n-- Rules:\n--   * anon and authenticated may SELECT every record, published or not.\n--   * Only editors of a record's organization may INSERT/UPDATE/DELETE it.\n--   * INSERT requires owner_id = auth.uid(). org_id and owner_id are immutable.\n--   * Clients have no access to organizations, memberships or shares.\n\nBEGIN;\n\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Membership lookup used by policies. SECURITY DEFINER lets policies read\n-- memberships without giving clients any SELECT on that table. The search\n-- path is pinned and the caller is identified only through auth.uid().\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Defense in depth: org_id and owner_id can never change, even if a grant\n-- is widened later.\nCREATE OR REPLACE FUNCTION private.records_keep_scope()\nRETURNS trigger\nLANGUAGE plpgsql SET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id\n     OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'records.org_id and records.owner_id are immutable'\n      USING ERRCODE = 'insufficient_privilege';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\nREVOKE ALL ON FUNCTION private.records_keep_scope() FROM PUBLIC;\n\nDROP TRIGGER IF EXISTS records_keep_scope ON public.records;\nCREATE TRIGGER records_keep_scope\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.records_keep_scope();\n\nCREATE INDEX IF NOT EXISTS records_org_id_idx ON public.records (org_id);\n\n-- Grants: start from nothing for client roles, then add back only what is needed.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\n\n-- RLS on every table. Tables without a policy deny all rows to clients.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nDROP POLICY IF EXISTS records_select_public ON public.records;\nCREATE POLICY records_select_public ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (true);\n\nDROP POLICY IF EXISTS records_insert_editor ON public.records;\nCREATE POLICY records_insert_editor ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    private.is_org_editor(org_id)\n    AND owner_id = (SELECT auth.uid())\n  );\n\nDROP POLICY IF EXISTS records_update_editor ON public.records;\nCREATE POLICY records_update_editor ON public.records\n  FOR UPDATE TO authenticated\n  USING (private.is_org_editor(org_id))\n  WITH CHECK (private.is_org_editor(org_id));\n\nDROP POLICY IF EXISTS records_delete_editor ON public.records;\nCREATE POLICY records_delete_editor ON public.records\n  FOR DELETE TO authenticated\n  USING (private.is_org_editor(org_id));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "522c1eb02283ce6e5db791e50d8c55987f200f065cdc27b15f253729ed0bf934",
          "sql": "-- 002: unpublished records become private drafts.\n-- Public readers, outsiders, other-org members and viewers may SELECT only\n-- published = true records. Editors of a record's organization still SELECT\n-- and manage every record in that organization, including publish state.\n-- Write rules, grants and the org_id/owner_id immutability trigger are unchanged.\n\nBEGIN;\n\nDROP POLICY IF EXISTS records_select_public ON public.records;\nDROP POLICY IF EXISTS records_select_published ON public.records;\nDROP POLICY IF EXISTS records_select_editor ON public.records;\n\n-- Permissive policies combine with OR. The anon role only matches the first\n-- policy, so it never needs EXECUTE on the membership helper.\nCREATE POLICY records_select_published ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (published);\n\nCREATE POLICY records_select_editor ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_editor(org_id));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 392214,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 122516
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-2-claude-baseline",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "5ca3fd5a372ef659ace6c1fb30377fdb2269475478869e45a2b34a9aa04299e4",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 217037,
          "wholeTreeTokens": 217037,
          "usageComplete": true,
          "actorElapsedMs": 88279,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 11,
          "skillReadCommandObserved": false,
          "migrationSha256": "52dab041a3e15fb6d32a44151f5c1ca6f879600b4e301d3598be3113f19d2189",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "18a54f6e474a22f029929d7c7c2f72350801ad7993fa632f6f0c8f84daea0844"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 178737,
          "wholeTreeTokens": 178737,
          "usageComplete": true,
          "actorElapsedMs": 55474,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 7,
          "skillReadCommandObserved": false,
          "migrationSha256": "a79682e0f80c2f433cfdda529e827c9da34819e2c77626b17b0aebd5fcdb89a6",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "96132c5c5f17bca09652b3a19165a12bc62cfb11594edf49f00bfe807f25de5a",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "52dab041a3e15fb6d32a44151f5c1ca6f879600b4e301d3598be3113f19d2189",
          "sql": "BEGIN;\n\n-- Membership check used by record policies. Runs as the owner (migrator) so it can\n-- read memberships without granting clients any access to that table.\nCREATE FUNCTION public.is_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.memberships m\n                  WHERE m.org_id = p_org_id AND m.user_id = auth.uid() AND m.access = 'editor') $$;\nREVOKE ALL ON FUNCTION public.is_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_editor(uuid) TO anon, authenticated;\n\nCREATE INDEX records_org_id_idx ON public.records (org_id);\n\n-- Start from zero client privileges on every table, including TRUNCATE/REFERENCES/TRIGGER.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\n-- Row Level Security on every table. Tables without policies are closed to clients.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships   ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records       ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares        ENABLE ROW LEVEL SECURITY;\n\n-- organizations: public read only (no policy for write, and no write grant).\nGRANT SELECT ON public.organizations TO anon, authenticated;\nCREATE POLICY organizations_select ON public.organizations FOR SELECT TO anon, authenticated\n  USING (true);\n\n-- records: public read; editors of the org write. org_id and owner_id are not in the\n-- UPDATE column grant, so they cannot be changed by clients.\nGRANT SELECT ON public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\n\nCREATE POLICY records_select ON public.records FOR SELECT TO anon, authenticated\n  USING (true);\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid()) AND public.is_editor(org_id));\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n  USING (public.is_editor(org_id))\n  WITH CHECK (public.is_editor(org_id));\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n  USING (public.is_editor(org_id));\n\n-- memberships and shares: no grants and no policies, so clients get no access.\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "a79682e0f80c2f433cfdda529e827c9da34819e2c77626b17b0aebd5fcdb89a6",
          "sql": "BEGIN;\n\n-- Unpublished records are private drafts: only published records are readable by\n-- anon/authenticated, and editors of the owning organization can read all of their\n-- org's records. Writes and identity/immutability rules are unchanged from 001.sql.\nDROP POLICY records_select ON public.records;\nCREATE POLICY records_select ON public.records FOR SELECT TO anon, authenticated\n  USING (published = true OR public.is_editor(org_id));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 395774,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 143753
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-2-codex-baseline",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "dac70b6084bf9aedebcd454f368955f1495cc618516c2f18de44134fea7bd14f",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 141878,
          "wholeTreeTokens": 141878,
          "usageComplete": true,
          "actorElapsedMs": 25347,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "9eaaad3bafc0b555bb6b0d2b2a2e9582ef9a91507c4481113bf05543cd822f24",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "0038f6a115dc45b2f88b0f041ed92294b69c8a20f0258e26945d636149a5e69e"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 110724,
          "wholeTreeTokens": 110724,
          "usageComplete": true,
          "actorElapsedMs": 16415,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "2267e18602f2a7a630e6a47878d01cb445742f8553cacfd265ceccc65e2fc3e9",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "817ab3b65038995869f57f56e01727a605a1a0fc2dc996c74fa0ecd889c8422d",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "9eaaad3bafc0b555bb6b0d2b2a2e9582ef9a91507c4481113bf05543cd822f24",
          "sql": "-- Public catalog reads; organization editors manage records within their org.\n\nCREATE FUNCTION public.is_org_editor(p_org_id uuid, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = p_user_id\n      AND m.access = 'editor'\n  )\n$function$;\n\nREVOKE ALL ON FUNCTION public.is_org_editor(uuid, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_org_editor(uuid, uuid) TO anon, authenticated;\n\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nREVOKE ALL ON TABLE public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT ON TABLE public.records TO anon, authenticated;\nGRANT INSERT (id, org_id, owner_id, body, published), DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_public_read\n  ON public.records FOR SELECT TO anon, authenticated\n  USING (true);\n\nCREATE POLICY records_editor_insert\n  ON public.records FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND (SELECT public.is_org_editor(org_id, (SELECT auth.uid())))\n  );\n\nCREATE POLICY records_editor_update\n  ON public.records FOR UPDATE TO authenticated\n  USING (\n    (SELECT public.is_org_editor(org_id, (SELECT auth.uid())))\n  )\n  WITH CHECK (\n    (SELECT public.is_org_editor(org_id, (SELECT auth.uid())))\n  );\n\nCREATE POLICY records_editor_delete\n  ON public.records FOR DELETE TO authenticated\n  USING (\n    (SELECT public.is_org_editor(org_id, (SELECT auth.uid())))\n  );\n"
        },
        {
          "stage": 2,
          "sha256": "2267e18602f2a7a630e6a47878d01cb445742f8553cacfd265ceccc65e2fc3e9",
          "sql": "-- Published records are public; drafts are visible only to their org editors.\nDROP POLICY records_public_read ON public.records;\n\nCREATE POLICY records_public_read\n  ON public.records FOR SELECT TO anon, authenticated\n  USING (\n    published\n    OR (\n      auth.uid() IS NOT NULL\n      AND (SELECT public.is_org_editor(org_id, (SELECT auth.uid())))\n    )\n  );\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 252602,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 41762
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-2-codex-skill",
      "task": "public-catalog",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "5fd8ebb470eacafc3228a4073ce278ee842e992ba5feb7d279f7c6c9210859e9",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 142004,
          "wholeTreeTokens": 142004,
          "usageComplete": true,
          "actorElapsedMs": 35988,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "66aa202bf9d6ba9139952dc4e0a14fa1439e2c01a728673bc9430c992c096349",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "ad1d02f3351ebc9d05fcc884d35c95e40de20a07c07cd258035b207aa1eadb9b"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 148701,
          "wholeTreeTokens": 148701,
          "usageComplete": true,
          "actorElapsedMs": 28002,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "303421376d0fdda176af74dcc4953d78410bda2a8e72c64b8b256eeeff0ae2af",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "60424102983346b3cc4d6699e960a28325a81cfc1c91f8d00cab290596bd6a31",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "66aa202bf9d6ba9139952dc4e0a14fa1439e2c01a728673bc9430c992c096349",
          "sql": "-- Client access for the initial public catalog release.\n\n-- Clients access records directly. Keep every other base table private.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nREVOKE ALL PRIVILEGES ON TABLE\n  public.organizations,\n  public.memberships,\n  public.records,\n  public.shares\nFROM PUBLIC, anon, authenticated;\n\n-- Catalog records are public, including unpublished records in this initial version.\nGRANT SELECT ON TABLE public.records TO anon, authenticated;\n\n-- Authenticated editors may manage records; row policies scope writes to their org.\nGRANT INSERT (id, org_id, owner_id, body, published),\n      UPDATE (body, published),\n      DELETE ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_public_read\n  ON public.records FOR SELECT\n  TO anon, authenticated\n  USING (true);\n\n-- Memberships are deliberately not directly readable by clients. This narrowly\n-- scoped helper lets record policies check editor status without granting access\n-- to membership facts.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$function$;\n\nREVOKE ALL ON FUNCTION private.is_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_editor(uuid) TO authenticated;\n\nCREATE POLICY records_editor_insert\n  ON public.records FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND (SELECT private.is_editor(org_id))\n  );\n\nCREATE POLICY records_editor_update\n  ON public.records FOR UPDATE\n  TO authenticated\n  USING ((SELECT private.is_editor(org_id)))\n  WITH CHECK ((SELECT private.is_editor(org_id)));\n\nCREATE POLICY records_editor_delete\n  ON public.records FOR DELETE\n  TO authenticated\n  USING ((SELECT private.is_editor(org_id)));\n"
        },
        {
          "stage": 2,
          "sha256": "303421376d0fdda176af74dcc4953d78410bda2a8e72c64b8b256eeeff0ae2af",
          "sql": "-- Unpublished records are private to editors in their organization.\n-- Published catalog records remain readable by both client roles.\nDROP POLICY records_public_read ON public.records;\n\nCREATE POLICY records_published_read\n  ON public.records FOR SELECT\n  TO anon, authenticated\n  USING (published);\n\nCREATE POLICY records_editor_read\n  ON public.records FOR SELECT\n  TO authenticated\n  USING ((SELECT private.is_editor(org_id)));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 290705,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 63990
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-1-codex-baseline",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "ba5e36157b0d127e46d0bf6789c4f28b187382579b8c5e47c6febe6c38f8d18b",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 112839,
          "wholeTreeTokens": 112839,
          "usageComplete": true,
          "actorElapsedMs": 28375,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "dfe43db0b4629be0ea63106e7cf0d06188b878bd4b0dbf01d6ec33ec23db8c6b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "91c68512a857d4961373dc8563a79091bc80183a8a7db89f1b9dfea05c92ae79"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 97141,
          "wholeTreeTokens": 97141,
          "usageComplete": true,
          "actorElapsedMs": 19431,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "3c2dcc90b6bb51d9179669e0d33731e51972d5eb5e12588ee5566b4cdc57b605",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "47cf206beb00613b6bedb5aa46915331df065c5266220a01064670820d04cb80",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "dfe43db0b4629be0ea63106e7cf0d06188b878bd4b0dbf01d6ec33ec23db8c6b",
          "sql": "BEGIN;\n\n-- Client roles receive no direct access to organization or membership data.\nREVOKE ALL ON TABLE public.organizations, public.memberships FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON TABLE public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- These lookups run with the table owner's rights so policies need not expose\n-- membership or neighboring share rows to clients.\nCREATE FUNCTION public.is_editor_member(p_org_id uuid, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = p_user_id\n      AND m.access = 'editor'\n  )\n$$;\n\nCREATE FUNCTION public.is_record_owner(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = p_record_id AND r.owner_id = p_user_id\n  )\n$$;\n\nCREATE FUNCTION public.is_record_shared_with(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares s\n    WHERE s.record_id = p_record_id AND s.user_id = p_user_id\n  )\n$$;\n\nREVOKE ALL ON FUNCTION public.is_editor_member(uuid, uuid) FROM PUBLIC, anon;\nREVOKE ALL ON FUNCTION public.is_record_owner(integer, uuid) FROM PUBLIC, anon;\nREVOKE ALL ON FUNCTION public.is_record_shared_with(integer, uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION public.is_editor_member(uuid, uuid),\n  public.is_record_owner(integer, uuid),\n  public.is_record_shared_with(integer, uuid) TO authenticated;\n\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.records, public.shares TO authenticated;\n-- Column grants make record organization and owner immutable to clients.\nREVOKE UPDATE ON public.records FROM authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\n\nCREATE POLICY records_select ON public.records\n  FOR SELECT TO authenticated\n  USING (owner_id = (SELECT auth.uid())\n         OR public.is_record_shared_with(id, (SELECT auth.uid())));\n\nCREATE POLICY records_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid())\n              AND public.is_editor_member(org_id, (SELECT auth.uid())));\n\nCREATE POLICY records_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (owner_id = (SELECT auth.uid()))\n  WITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_select ON public.shares\n  FOR SELECT TO authenticated\n  USING (public.is_record_owner(record_id, (SELECT auth.uid())));\n\nCREATE POLICY shares_insert ON public.shares\n  FOR INSERT TO authenticated\n  WITH CHECK (public.is_record_owner(record_id, (SELECT auth.uid())));\n\nCREATE POLICY shares_update ON public.shares\n  FOR UPDATE TO authenticated\n  USING (public.is_record_owner(record_id, (SELECT auth.uid())))\n  WITH CHECK (public.is_record_owner(record_id, (SELECT auth.uid())));\n\nCREATE POLICY shares_delete ON public.shares\n  FOR DELETE TO authenticated\n  USING (public.is_record_owner(record_id, (SELECT auth.uid())));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "3c2dcc90b6bb51d9179669e0d33731e51972d5eb5e12588ee5566b4cdc57b605",
          "sql": "BEGIN;\n\n-- A share grants read access only while active. Keep the lookup isolated\n-- behind the existing security-definer helper so recipients cannot inspect\n-- shares or records adjacent to the one shared with them.\nCREATE OR REPLACE FUNCTION public.is_record_shared_with(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares s\n    WHERE s.record_id = p_record_id\n      AND s.user_id = p_user_id\n      AND s.active IS TRUE\n  )\n$$;\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 209980,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 47806
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-1-codex-skill",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "cbf3ded6b9fa6656a25f8cbe654d4e51700b4c923de7bcfeff79266b558c3e01",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 217282,
          "wholeTreeTokens": 217282,
          "usageComplete": true,
          "actorElapsedMs": 60929,
          "observedModel": null,
          "toolCommands": 8,
          "skillReadCommandObserved": true,
          "migrationSha256": "79f723f0d0d26583bb11dfb57ed0f95f960ed413f5efb60ffcf5f4674578af17",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "28fd81f9f033580b45e7cd33833c34c861397f09601ce1aa7ffa50620c53bed3"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 131405,
          "wholeTreeTokens": 131405,
          "usageComplete": true,
          "actorElapsedMs": 38709,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "52901e0048e24addfb028993e755e96b40c2157af5c5a5e5ea90c9b7f6641e9f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "c52c61469d9657c21256c7078bc61fd62f5f4c1768b9348c237b878d2dd3b736",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "79f723f0d0d26583bb11dfb57ed0f95f960ed413f5efb60ffcf5f4674578af17",
          "sql": "-- Initial client access rules for records and their per-user shares.\n\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_editor_member(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$function$;\n\nCREATE FUNCTION private.owns_record(p_record_id integer)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.records AS r\n    WHERE r.id = p_record_id\n      AND r.owner_id = (SELECT auth.uid())\n  );\n$function$;\n\nCREATE FUNCTION private.has_record_share(p_record_id integer)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.shares AS s\n    WHERE s.record_id = p_record_id\n      AND s.user_id = (SELECT auth.uid())\n  );\n$function$;\n\nREVOKE ALL ON FUNCTION private.is_editor_member(uuid) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION private.owns_record(integer) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION private.has_record_share(integer) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION private.is_editor_member(uuid) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.owns_record(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.has_record_share(integer) TO authenticated;\n\nCREATE INDEX shares_user_record_idx ON public.shares (user_id, record_id);\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nREVOKE ALL ON TABLE public.organizations, public.memberships FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON TABLE public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares TO authenticated;\n\nCREATE POLICY records_select_owner_or_shared\nON public.records FOR SELECT TO authenticated\nUSING (\n  owner_id = (SELECT auth.uid())\n  OR (SELECT private.has_record_share(id))\n);\n\nCREATE POLICY records_insert_editor_owner\nON public.records FOR INSERT TO authenticated\nWITH CHECK (\n  owner_id = (SELECT auth.uid())\n  AND (SELECT private.is_editor_member(org_id))\n);\n\nCREATE POLICY records_update_owner\nON public.records FOR UPDATE TO authenticated\nUSING (owner_id = (SELECT auth.uid()))\nWITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete_owner\nON public.records FOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_select_record_owner\nON public.shares FOR SELECT TO authenticated\nUSING ((SELECT private.owns_record(record_id)));\n\nCREATE POLICY shares_insert_record_owner\nON public.shares FOR INSERT TO authenticated\nWITH CHECK ((SELECT private.owns_record(record_id)));\n\nCREATE POLICY shares_update_record_owner\nON public.shares FOR UPDATE TO authenticated\nUSING ((SELECT private.owns_record(record_id)))\nWITH CHECK ((SELECT private.owns_record(record_id)));\n\nCREATE POLICY shares_delete_record_owner\nON public.shares FOR DELETE TO authenticated\nUSING ((SELECT private.owns_record(record_id)));\n"
        },
        {
          "stage": 2,
          "sha256": "52901e0048e24addfb028993e755e96b40c2157af5c5a5e5ea90c9b7f6641e9f",
          "sql": "-- Revoked shares no longer grant access to their recipient.\nCREATE OR REPLACE FUNCTION private.has_record_share(p_record_id integer)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.shares AS s\n    WHERE s.record_id = p_record_id\n      AND s.user_id = (SELECT auth.uid())\n      AND s.active IS TRUE\n  );\n$function$;\n\n-- Keep the helper callable only from the authenticated record policy.\nREVOKE ALL ON FUNCTION private.has_record_share(integer) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION private.has_record_share(integer) TO authenticated;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 348687,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 99638
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-1-claude-baseline",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "3e7db859084c9b279e209857c65563ad36e70f8ac33e26c9ba8d606983b31105",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 241288,
          "wholeTreeTokens": 241288,
          "usageComplete": true,
          "actorElapsedMs": 119695,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": false,
          "migrationSha256": "0ae31d4494344b2ca989de27a773011227b84b441e94ab18999b2ecdbe5fe2c8",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "de7515dce4276b16485ade806cb447a7ac39b0b4e2c1ef62a644f174960e6a85"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 120056,
          "wholeTreeTokens": 120056,
          "usageComplete": true,
          "actorElapsedMs": 40640,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "d08b85d8585e3f7652f918e76d5ebe8a4063ba8023363c4aa4accc66d80b22a0",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "c063142e6e10997a4850601f0518b1521a615f064190a5c5d94a43b44ce26d1b",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "0ae31d4494344b2ca989de27a773011227b84b441e94ab18999b2ecdbe5fe2c8",
          "sql": "-- 001: initial row-level access rules for records and shares.\n-- Runs as migrator (table owner, NOBYPASSRLS). RLS is not FORCEd, so the\n-- SECURITY DEFINER helpers below read the base tables without re-entering\n-- policies, which breaks the records <-> shares policy cycle.\nBEGIN;\n\n-- Helpers (no RLS re-entry; search_path pinned; clients get EXECUTE only)\nCREATE OR REPLACE FUNCTION public.is_editor_of(p_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.memberships m\n     WHERE m.org_id = p_org AND m.user_id = auth.uid() AND m.access = 'editor') $$;\n\nCREATE OR REPLACE FUNCTION public.owns_record(p_record integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.records r\n     WHERE r.id = p_record AND r.owner_id = auth.uid()) $$;\n\n-- Any share row grants read, regardless of its active flag (initial version).\nCREATE OR REPLACE FUNCTION public.is_shared_with_me(p_record integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n     WHERE s.record_id = p_record AND s.user_id = auth.uid()) $$;\n\nREVOKE ALL ON FUNCTION public.is_editor_of(uuid), public.owns_record(integer),\n  public.is_shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_editor_of(uuid), public.owns_record(integer),\n  public.is_shared_with_me(integer) TO authenticated;\n\n-- org_id and owner_id are immutable on update (defense in depth beyond column grants)\nCREATE OR REPLACE FUNCTION public.records_keep_scope() RETURNS trigger\nLANGUAGE plpgsql AS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'records.org_id and records.owner_id are immutable'\n      USING ERRCODE = 'check_violation';\n  END IF;\n  RETURN NEW;\nEND $$;\n\nREVOKE ALL ON FUNCTION public.records_keep_scope() FROM PUBLIC;\n\nDROP TRIGGER IF EXISTS records_keep_scope ON public.records;\nCREATE TRIGGER records_keep_scope BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION public.records_keep_scope();\n\n-- Indexes for policy lookups\nCREATE INDEX IF NOT EXISTS records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX IF NOT EXISTS shares_user_id_idx ON public.shares (user_id);\n\n-- Grants: start from nothing for clients, then add only what is needed.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\n-- RLS\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nDROP POLICY IF EXISTS records_select ON public.records;\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n  USING (owner_id = (SELECT auth.uid()) OR public.is_shared_with_me(id));\n\nDROP POLICY IF EXISTS records_insert ON public.records;\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid()) AND public.is_editor_of(org_id));\n\nDROP POLICY IF EXISTS records_update ON public.records;\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n  USING (owner_id = (SELECT auth.uid()))\n  WITH CHECK (owner_id = (SELECT auth.uid()));\n\nDROP POLICY IF EXISTS records_delete ON public.records;\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n  USING (owner_id = (SELECT auth.uid()));\n\nDROP POLICY IF EXISTS shares_select ON public.shares;\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n  USING (public.owns_record(record_id));\n\nDROP POLICY IF EXISTS shares_insert ON public.shares;\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n  WITH CHECK (public.owns_record(record_id));\n\nDROP POLICY IF EXISTS shares_update ON public.shares;\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n  USING (public.owns_record(record_id))\n  WITH CHECK (public.owns_record(record_id));\n\nDROP POLICY IF EXISTS shares_delete ON public.shares;\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n  USING (public.owns_record(record_id));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "d08b85d8585e3f7652f918e76d5ebe8a4063ba8023363c4aa4accc66d80b22a0",
          "sql": "-- 002: only active share rows grant read access. Owners revoke by setting\n-- shares.active=false or deleting the row. Runs as migrator after 001.sql.\n-- CREATE OR REPLACE keeps the EXECUTE ACL from 001; the helper still reads\n-- shares as its owner (RLS not FORCEd), so records_select does not recurse.\nBEGIN;\n\nCREATE OR REPLACE FUNCTION public.is_shared_with_me(p_record integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n     WHERE s.record_id = p_record AND s.user_id = auth.uid() AND s.active) $$;\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 361344,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 160335
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-1-claude-skill",
      "task": "document-sharing",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "d25ec492f3380104d7a80415a63091a1abf560cdc4ebe67a61e5f1dc8c2279aa",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 297798,
          "wholeTreeTokens": 297798,
          "usageComplete": true,
          "actorElapsedMs": 108131,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 11,
          "skillReadCommandObserved": true,
          "migrationSha256": "3ec9ce01feffed2b5bb1376d45ffa21329e81dc58e9e73b2a23324cc15d2589e",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "83579f7e4adaac63e365055fa07c54cbb7608e624f76484b92bd275124dbc49c"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 249628,
          "wholeTreeTokens": 249628,
          "usageComplete": true,
          "actorElapsedMs": 71667,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 9,
          "skillReadCommandObserved": false,
          "migrationSha256": "33116699f5257b6d4dbf121ab09fb712d9a2d56829627f612221038bdf9ee7dc",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "61f7fb2045af05bf0f5e6dd1b53b038e89ba778aeed54695ea74fd158fe1f566",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "3ec9ce01feffed2b5bb1376d45ffa21329e81dc58e9e73b2a23324cc15d2589e",
          "sql": "-- Access rules for clients (anon, authenticated). Runs as migrator (table owner, NOBYPASSRLS).\n-- Helper functions live in a private schema and are SECURITY DEFINER so policies can look up\n-- memberships, shares and records without re-entering RLS (records and shares policies would\n-- otherwise recurse into each other). Only authenticated may execute them.\n\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Lookup indexes used by the policy helpers.\nCREATE INDEX records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX records_org_id_idx ON public.records (org_id);\nCREATE INDEX shares_user_id_idx ON public.shares (user_id);\n\n-- True when the caller is an editor of the given organization.\nCREATE FUNCTION private.is_org_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (\n     SELECT 1 FROM public.memberships m\n     WHERE m.org_id = p_org_id AND m.user_id = (SELECT auth.uid()) AND m.access = 'editor'\n   ) $$;\n\n-- True when the caller owns the given record.\nCREATE FUNCTION private.is_record_owner(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (\n     SELECT 1 FROM public.records r\n     WHERE r.id = p_record_id AND r.owner_id = (SELECT auth.uid())\n   ) $$;\n\n-- True when a share row exists for the caller. The active flag is deliberately ignored:\n-- in this version every share row grants read access.\nCREATE FUNCTION private.is_shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (\n     SELECT 1 FROM public.shares s\n     WHERE s.record_id = p_record_id AND s.user_id = (SELECT auth.uid())\n   ) $$;\n\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nREVOKE ALL ON FUNCTION private.is_record_owner(integer) FROM PUBLIC;\nREVOKE ALL ON FUNCTION private.is_shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_record_owner(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_shared_with_me(integer) TO authenticated;\n\n-- Defense in depth: org_id, owner_id and id can never change on an existing record,\n-- even if a future grant or a direct owner-role session attempts it.\nCREATE FUNCTION private.records_keep_identity() RETURNS trigger\nLANGUAGE plpgsql AS\n$$\nBEGIN\n  IF NEW.id IS DISTINCT FROM OLD.id\n     OR NEW.org_id IS DISTINCT FROM OLD.org_id\n     OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'records.id, org_id and owner_id are immutable'\n      USING ERRCODE = '42501';\n  END IF;\n  RETURN NEW;\nEND\n$$;\n\nCREATE TRIGGER records_keep_identity BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.records_keep_identity();\n\n-- Grants: start from nothing, then give back only what clients need.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\n\n-- Records: client writes may only touch body and published.\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\n\n-- Shares: managed only by the record owner (enforced by policies).\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Records policies.\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n  USING (owner_id = (SELECT auth.uid()) OR private.is_shared_with_me(id));\n\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid()) AND private.is_org_editor(org_id));\n\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n  USING (owner_id = (SELECT auth.uid()))\n  WITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n  USING (owner_id = (SELECT auth.uid()));\n\n-- Shares policies: only the owner of the referenced record.\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n  USING (private.is_record_owner(record_id));\n\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n  WITH CHECK (private.is_record_owner(record_id));\n\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n  USING (private.is_record_owner(record_id))\n  WITH CHECK (private.is_record_owner(record_id));\n\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n  USING (private.is_record_owner(record_id));\n"
        },
        {
          "stage": 2,
          "sha256": "33116699f5257b6d4dbf121ab09fb712d9a2d56829627f612221038bdf9ee7dc",
          "sql": "-- Share revocation: only active=true share rows grant read access.\n-- Owners revoke by setting shares.active=false or by deleting the share row.\n-- Replacing the helper in place keeps its owner (migrator) and its EXECUTE grant for authenticated.\n-- Policies are unchanged: they already call this helper per statement, so a revocation\n-- committed by the owner is honored by the next statement.\nCREATE OR REPLACE FUNCTION private.is_shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (\n     SELECT 1 FROM public.shares s\n     WHERE s.record_id = p_record_id AND s.user_id = (SELECT auth.uid()) AND s.active\n   ) $$;\n\nREVOKE ALL ON FUNCTION private.is_shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_shared_with_me(integer) TO authenticated;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 547426,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 179798
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-2-claude-baseline",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "ca81aaeddd61a6118a6c3af3a47c223fb40e6a891efc1256b3ef47db8e8e1feb",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 298767,
          "wholeTreeTokens": 298767,
          "usageComplete": true,
          "actorElapsedMs": 103459,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": false,
          "migrationSha256": "6fb920dfb778294ce2be8572b02f6cec4e967a544c4b3e0e427ca9867c1d8d28",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "f0f811925d4ec1de4577bea252e0b880e302571e3d32bea20a3c9c9c77d60057"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 78969,
          "wholeTreeTokens": 78969,
          "usageComplete": true,
          "actorElapsedMs": 33960,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "213fef4307b725d66036e153ae9eeca9520809004d78ca88d36b50ba9b14ec3e",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "fda11849194cd41a2fa390dc4af59b342c481bfaa09232b0639d985eb71035de",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "6fb920dfb778294ce2be8572b02f6cec4e967a544c4b3e0e427ca9867c1d8d28",
          "sql": "-- Initial access model: client grants, helper functions, and RLS policies.\n-- Runs as migrator (table owner, NOBYPASSRLS, not superuser).\n\n-- Helpers run as their owner (migrator), which bypasses RLS on the base tables.\n-- This breaks the records <-> shares policy recursion and keeps memberships unreadable to clients.\nCREATE SCHEMA app_private;\nGRANT USAGE ON SCHEMA app_private TO authenticated;\n\nCREATE FUNCTION app_private.is_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.memberships m\n   WHERE m.org_id = p_org_id AND m.user_id = auth.uid() AND m.access = 'editor') $$;\n\nCREATE FUNCTION app_private.is_record_owner(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.records r\n   WHERE r.id = p_record_id AND r.owner_id = auth.uid()) $$;\n\nCREATE FUNCTION app_private.is_shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n   WHERE s.record_id = p_record_id AND s.user_id = auth.uid()) $$;\n\nREVOKE ALL ON FUNCTION app_private.is_editor(uuid) FROM PUBLIC;\nREVOKE ALL ON FUNCTION app_private.is_record_owner(integer) FROM PUBLIC;\nREVOKE ALL ON FUNCTION app_private.is_shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION app_private.is_editor(uuid) TO authenticated;\nGRANT EXECUTE ON FUNCTION app_private.is_record_owner(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION app_private.is_shared_with_me(integer) TO authenticated;\n\n-- Grants: start from nothing for clients, then add only what the access model needs.\n-- organizations and memberships get no client privileges at all.\nREVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC, anon, authenticated;\n\n-- org_id and owner_id (and id) are immutable: UPDATE is granted on body and published only.\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nCREATE INDEX records_owner_id_idx ON public.records (owner_id);\n\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- records: owners get full CRUD on their own rows; sharees get SELECT only.\nCREATE POLICY records_owner_select ON public.records FOR SELECT TO authenticated\n  USING (owner_id = auth.uid());\nCREATE POLICY records_shared_select ON public.records FOR SELECT TO authenticated\n  USING (app_private.is_shared_with_me(id));\nCREATE POLICY records_owner_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (owner_id = auth.uid() AND app_private.is_editor(org_id));\nCREATE POLICY records_owner_update ON public.records FOR UPDATE TO authenticated\n  USING (owner_id = auth.uid()) WITH CHECK (owner_id = auth.uid());\nCREATE POLICY records_owner_delete ON public.records FOR DELETE TO authenticated\n  USING (owner_id = auth.uid());\n\n-- shares: only the owner of the record manages its share rows. Every share row grants read.\nCREATE POLICY shares_owner_select ON public.shares FOR SELECT TO authenticated\n  USING (app_private.is_record_owner(record_id));\nCREATE POLICY shares_owner_insert ON public.shares FOR INSERT TO authenticated\n  WITH CHECK (app_private.is_record_owner(record_id));\nCREATE POLICY shares_owner_update ON public.shares FOR UPDATE TO authenticated\n  USING (app_private.is_record_owner(record_id))\n  WITH CHECK (app_private.is_record_owner(record_id));\nCREATE POLICY shares_owner_delete ON public.shares FOR DELETE TO authenticated\n  USING (app_private.is_record_owner(record_id));\n"
        },
        {
          "stage": 2,
          "sha256": "213fef4307b725d66036e153ae9eeca9520809004d78ca88d36b50ba9b14ec3e",
          "sql": "-- Revocable sharing: only active share rows grant read access.\n-- Runs as migrator (table owner, NOBYPASSRLS, not superuser), after 001.sql.\n\n-- Replaces the helper in place so the existing records_shared_select policy and grants are kept.\n-- Helper runs as its owner (migrator), so it sees share rows regardless of client RLS.\nCREATE OR REPLACE FUNCTION app_private.is_shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n   WHERE s.record_id = p_record_id AND s.user_id = auth.uid() AND s.active) $$;\n\n-- Supports the active-share lookup used by records_shared_select.\nCREATE INDEX shares_active_user_idx ON public.shares (user_id, record_id) WHERE active;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 377736,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 137419
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-2-claude-skill",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "1d7d7205668fa2c8ae435658352a4a807a7a83c53f4b6ca1229284f6efbdcb75",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 116387,
          "wholeTreeTokens": 116387,
          "usageComplete": true,
          "actorElapsedMs": 65855,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "a0afad778f8b29fc388d7b9fbb1493b3376df553f0d1e9993cd393cb45241870",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "5abf3a9c51e74f37c7582dcd0cdc6121c8a938e44bdd6cd14aefdac18b5cd13f"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 108991,
          "wholeTreeTokens": 108991,
          "usageComplete": true,
          "actorElapsedMs": 61320,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "8c58e2886cca8c5c74390b7d8d9bf6781d6f37bba57c3bee22f5c5119f4cea51",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "3ddebf6212f5d7a27ae8c5788f60a6c3b70fea3cf5fb4e46a5e3b0bea69adebb",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "a0afad778f8b29fc388d7b9fbb1493b3376df553f0d1e9993cd393cb45241870",
          "sql": "-- 001: initial row access model for records and shares.\n-- Clients (anon, authenticated) get only the grants and RLS policies below.\n-- The auth.uid() helper is not changed. Membership and organization tables stay closed.\n\n-- Private helpers. SECURITY DEFINER runs as the owner (migrator), so the\n-- lookups do not recurse through RLS on records/shares. Each helper checks\n-- auth.uid() itself. Only authenticated may execute them.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.memberships m\n                  WHERE m.org_id = p_org_id AND m.user_id = auth.uid() AND m.access = 'editor') $$;\n\nCREATE FUNCTION private.owns_record(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.records r\n                  WHERE r.id = p_record_id AND r.owner_id = auth.uid()) $$;\n\n-- Any share row grants read, regardless of its active flag (initial version).\nCREATE FUNCTION private.shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n                  WHERE s.record_id = p_record_id AND s.user_id = auth.uid()) $$;\n\nREVOKE ALL ON FUNCTION private.is_editor(uuid) FROM PUBLIC;\nREVOKE ALL ON FUNCTION private.owns_record(integer) FROM PUBLIC;\nREVOKE ALL ON FUNCTION private.shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_editor(uuid) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.owns_record(integer) TO authenticated;\nGRANT EXECUTE ON FUNCTION private.shared_with_me(integer) TO authenticated;\n\n-- Grants: start from nothing for clients, then add back only what is needed.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\n-- Column-level UPDATE: id, org_id and owner_id are not writable by clients.\nGRANT UPDATE (body, published) ON public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.shares TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Records\nCREATE POLICY records_select ON public.records FOR SELECT TO authenticated\n  USING (owner_id = (SELECT auth.uid()) OR private.shared_with_me(id));\n\nCREATE POLICY records_insert ON public.records FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid()) AND private.is_editor(org_id));\n\nCREATE POLICY records_update ON public.records FOR UPDATE TO authenticated\n  USING (owner_id = (SELECT auth.uid()))\n  WITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete ON public.records FOR DELETE TO authenticated\n  USING (owner_id = (SELECT auth.uid()));\n\n-- Shares: only the record owner manages share rows.\nCREATE POLICY shares_select ON public.shares FOR SELECT TO authenticated\n  USING (private.owns_record(record_id));\n\nCREATE POLICY shares_insert ON public.shares FOR INSERT TO authenticated\n  WITH CHECK (private.owns_record(record_id));\n\nCREATE POLICY shares_update ON public.shares FOR UPDATE TO authenticated\n  USING (private.owns_record(record_id))\n  WITH CHECK (private.owns_record(record_id));\n\nCREATE POLICY shares_delete ON public.shares FOR DELETE TO authenticated\n  USING (private.owns_record(record_id));\n\n-- Indexes for policy lookups.\nCREATE INDEX records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX shares_user_id_idx ON public.shares (user_id);\n"
        },
        {
          "stage": 2,
          "sha256": "8c58e2886cca8c5c74390b7d8d9bf6781d6f37bba57c3bee22f5c5119f4cea51",
          "sql": "-- 002: revocable sharing. Only active share rows grant read access.\n-- Owners revoke by setting shares.active = false or by deleting the row.\n-- The helper is replaced in place (same name, parameter, owner and ACL), so\n-- records_select keeps referencing it. Share management and record writes are\n-- unchanged from 001: only the record owner touches shares, and recipients\n-- can neither see nor change share rows.\n\nCREATE OR REPLACE FUNCTION private.shared_with_me(p_record_id integer) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS\n$$ SELECT EXISTS (SELECT 1 FROM public.shares s\n                  WHERE s.record_id = p_record_id AND s.user_id = auth.uid() AND s.active = true) $$;\n\nREVOKE ALL ON FUNCTION private.shared_with_me(integer) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.shared_with_me(integer) TO authenticated;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 225378,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 127175
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-2-codex-baseline",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "33c2275e9c9525bc9e31a7648237cb85b133b5ae7d8f8caf78cbfb9344f09a9a",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 132822,
          "wholeTreeTokens": 132822,
          "usageComplete": true,
          "actorElapsedMs": 31705,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "2ce0ec4a26f9b6af2e2e4c087bd4b4c4575766068f01a951eea3729ea8ab11e6",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "b61431aea36f10cc74f94949b74517714609b0815dd813b64ee9f0ad1180827a"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 144053,
          "wholeTreeTokens": 144053,
          "usageComplete": true,
          "actorElapsedMs": 18090,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "fb170c9658ab9559278fef2290080cac6bf3b92197d195a35e4125c0e79bd812",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1b2b3085d3fde1d549e260ac76de6a9ed224d4c2dc62d87c4022c47c4d6de964",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "2ce0ec4a26f9b6af2e2e4c087bd4b4c4575766068f01a951eea3729ea8ab11e6",
          "sql": "BEGIN;\n\n-- Keep membership facts private while allowing record creation to verify editor status.\nCREATE FUNCTION public.is_editor_member(target_org uuid, target_user uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = target_org\n      AND m.user_id = target_user\n      AND m.access = 'editor'\n  )\n$function$;\nREVOKE ALL ON FUNCTION public.is_editor_member(uuid, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_editor_member(uuid, uuid) TO authenticated;\n\nCREATE FUNCTION public.can_read_record(target_record integer, target_user uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (SELECT 1 FROM public.records r WHERE r.id = target_record AND r.owner_id = target_user)\n      OR EXISTS (SELECT 1 FROM public.shares s WHERE s.record_id = target_record AND s.user_id = target_user)\n$function$;\nCREATE FUNCTION public.owns_record(target_record integer, target_user uuid)\nRETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (SELECT 1 FROM public.records r WHERE r.id = target_record AND r.owner_id = target_user)\n$function$;\nREVOKE ALL ON FUNCTION public.can_read_record(integer, uuid), public.owns_record(integer, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.can_read_record(integer, uuid), public.owns_record(integer, uuid) TO authenticated;\n\nREVOKE ALL ON TABLE public.organizations, public.memberships FROM anon, authenticated;\nREVOKE ALL ON TABLE public.records, public.shares FROM anon, authenticated;\n\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.shares TO authenticated;\n\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- No client policies for organizations or memberships.\n\nCREATE POLICY records_select\nON public.records FOR SELECT TO authenticated\nUSING (public.can_read_record(id, (SELECT auth.uid())));\n\nCREATE POLICY records_insert\nON public.records FOR INSERT TO authenticated\nWITH CHECK (\n  owner_id = (SELECT auth.uid())\n  AND public.is_editor_member(org_id, (SELECT auth.uid()))\n);\n\nCREATE POLICY records_update\nON public.records FOR UPDATE TO authenticated\nUSING (owner_id = (SELECT auth.uid()))\nWITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete\nON public.records FOR DELETE TO authenticated\nUSING (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY shares_select\nON public.shares FOR SELECT TO authenticated\nUSING (\n  public.owns_record(record_id, (SELECT auth.uid()))\n);\n\nCREATE POLICY shares_insert\nON public.shares FOR INSERT TO authenticated\nWITH CHECK (\n  public.owns_record(record_id, (SELECT auth.uid()))\n);\n\nCREATE POLICY shares_update\nON public.shares FOR UPDATE TO authenticated\nUSING (\n  public.owns_record(record_id, (SELECT auth.uid()))\n)\nWITH CHECK (\n  public.owns_record(record_id, (SELECT auth.uid()))\n);\n\nCREATE POLICY shares_delete\nON public.shares FOR DELETE TO authenticated\nUSING (\n  public.owns_record(record_id, (SELECT auth.uid()))\n);\n\nCREATE INDEX records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX shares_user_record_idx ON public.shares (user_id, record_id);\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "fb170c9658ab9559278fef2290080cac6bf3b92197d195a35e4125c0e79bd812",
          "sql": "BEGIN;\n\n-- Shared records are readable only while the owner's share remains active.\n-- SECURITY DEFINER allows the policy helper to inspect shares without exposing\n-- share rows to recipients; the caller supplies the authenticated identity.\nCREATE OR REPLACE FUNCTION public.can_read_record(target_record integer, target_user uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n           SELECT 1\n           FROM public.records AS r\n           WHERE r.id = target_record\n             AND r.owner_id = target_user\n         )\n      OR EXISTS (\n           SELECT 1\n           FROM public.shares AS s\n           WHERE s.record_id = target_record\n             AND s.user_id = target_user\n             AND s.active = true\n         )\n$function$;\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 276875,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 49795
    },
    {
      "phase": "lower-models-01",
      "id": "document-sharing-2-codex-skill",
      "task": "document-sharing",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "85ba3c4073b585397f51d3e019ed8b9efa21729cf393b8bce1881fd39b13246e",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"shares\"\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 41,
          "totalChecks": 41
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "owner retains both documents",
              "passed": true,
              "returncode": 0,
              "actual": "1,2",
              "expected": "1,2",
              "stderr": ""
            },
            {
              "name": "other owner isolated",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "recipient receives only selected shares",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "unshared editor sees own document only",
              "passed": true,
              "returncode": 0,
              "actual": "5",
              "expected": "5",
              "stderr": ""
            },
            {
              "name": "owner updates own document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner deletes own unshared document",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "peer cannot edit owner's document",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "owner may create share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may deactivate share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "owner may remove share",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "recipient cannot create shares",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "recipient cannot reactivate shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot delete shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "recipient cannot inspect shares",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "immediate revocation: UPDATE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "immediate revocation: DELETE",
              "passed": true,
              "actual": "0",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 43,
          "totalChecks": 43
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 151011,
          "wholeTreeTokens": 151011,
          "usageComplete": true,
          "actorElapsedMs": 38259,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "1cb74c0da8f0c6d665f47ea6388e8c2aab53fce4adb867b9781aef3eadd1f0f5",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1ed8c920b3f37a42e1e43387103982cad77abe9eb15f441d12ca856c3733f551"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 174354,
          "wholeTreeTokens": 174354,
          "usageComplete": true,
          "actorElapsedMs": 26843,
          "observedModel": null,
          "toolCommands": 7,
          "skillReadCommandObserved": true,
          "migrationSha256": "f3f9391a19f67c395c4fda02827acdc6bb8e0c1fbe7288b9b3a1953b5c82b29c",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "b0faf50ec2186697d5339581aed2abd589308f9e5fffa3936fd344b78149f52c",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "1cb74c0da8f0c6d665f47ea6388e8c2aab53fce4adb867b9781aef3eadd1f0f5",
          "sql": "BEGIN;\n\n-- Keep client access limited to the four application operations. In particular,\n-- no TRUNCATE, REFERENCES, TRIGGER, or ownership-related privileges are granted.\nREVOKE ALL ON TABLE public.organizations, public.memberships,\n  public.records, public.shares FROM PUBLIC, anon, authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records, public.shares TO authenticated;\nGRANT USAGE ON SCHEMA public TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Private lookups avoid a policy cycle between records and shares and prevent\n-- membership details from being exposed to client roles.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_editor(p_org_id uuid, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id AND m.user_id = p_user_id AND m.access = 'editor'\n  )\n$$;\n\nCREATE FUNCTION private.has_record_share(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares s\n    WHERE s.record_id = p_record_id AND s.user_id = p_user_id\n  )\n$$;\n\nCREATE FUNCTION private.owns_record(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.records r\n    WHERE r.id = p_record_id AND r.owner_id = p_user_id\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_editor(uuid, uuid),\n  private.has_record_share(integer, uuid), private.owns_record(integer, uuid)\n  FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_editor(uuid, uuid),\n  private.has_record_share(integer, uuid), private.owns_record(integer, uuid)\n  TO authenticated;\n\nCREATE POLICY records_select_owner_or_shared ON public.records\n  FOR SELECT TO authenticated\n  USING (\n    owner_id = (SELECT auth.uid())\n    OR (SELECT private.has_record_share(id, (SELECT auth.uid())))\n  );\n\nCREATE POLICY records_insert_owner_editor ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND (SELECT private.is_editor(org_id, (SELECT auth.uid())))\n  );\n\nCREATE POLICY records_update_owner ON public.records\n  FOR UPDATE TO authenticated\n  USING (owner_id = (SELECT auth.uid()))\n  WITH CHECK (owner_id = (SELECT auth.uid()));\n\nCREATE POLICY records_delete_owner ON public.records\n  FOR DELETE TO authenticated\n  USING (owner_id = (SELECT auth.uid()));\n\n-- Column-level UPDATE grants make organization and owner identity immutable.\nREVOKE UPDATE ON TABLE public.records FROM authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY shares_select_owner ON public.shares\n  FOR SELECT TO authenticated\n  USING ((SELECT private.owns_record(record_id, (SELECT auth.uid()))));\n\nCREATE POLICY shares_insert_owner ON public.shares\n  FOR INSERT TO authenticated\n  WITH CHECK ((SELECT private.owns_record(record_id, (SELECT auth.uid()))));\n\nCREATE POLICY shares_update_owner ON public.shares\n  FOR UPDATE TO authenticated\n  USING ((SELECT private.owns_record(record_id, (SELECT auth.uid()))))\n  WITH CHECK ((SELECT private.owns_record(record_id, (SELECT auth.uid()))));\n\nCREATE POLICY shares_delete_owner ON public.shares\n  FOR DELETE TO authenticated\n  USING ((SELECT private.owns_record(record_id, (SELECT auth.uid()))));\n\nCREATE INDEX records_owner_id_idx ON public.records (owner_id);\nCREATE INDEX shares_user_record_idx ON public.shares (user_id, record_id);\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "f3f9391a19f67c395c4fda02827acdc6bb8e0c1fbe7288b9b3a1953b5c82b29c",
          "sql": "BEGIN;\n\n-- Revoked shares remain visible only to their record owner, but no longer\n-- authorize recipients to read the record.\nCREATE OR REPLACE FUNCTION private.has_record_share(p_record_id integer, p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.shares s\n    WHERE s.record_id = p_record_id\n      AND s.user_id = p_user_id\n      AND s.active IS TRUE\n  )\n$$;\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 325365,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 65102
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-1-codex-baseline",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "96f9a76c41432b1d8b59c5ec8057ffb43a59290deef935329864776d3ad20b87",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 146511,
          "wholeTreeTokens": 146511,
          "usageComplete": true,
          "actorElapsedMs": 42260,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "71c1e23f6d4ac497e38e49ca6f922172985652dfa8a732b16d726bb2187841c1",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "48dfc3ec70d21e13b081188b85d5acbd8aa6f0d013a3c20ec31d767af4ab613e"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 142252,
          "wholeTreeTokens": 142252,
          "usageComplete": true,
          "actorElapsedMs": 25031,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "b15e4a6d01956a819c387b7bfad7f22b744f4115963e43fdf1876591db721cfb",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1df3a925f3fc4150cc3ba97a7924ae0849a132c687a9a4df87606fa32c49e8fc",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "71c1e23f6d4ac497e38e49ca6f922172985652dfa8a732b16d726bb2187841c1",
          "sql": "BEGIN;\n\n-- Remove any inherited or fixture defaults before granting the client API.\nREVOKE ALL PRIVILEGES ON TABLE public.organizations, public.memberships,\n  public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- The lookup tables and shares are private to the migration/trusted server.\n-- Clients receive no table privileges on these relations.\n\nGRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.records TO anon, authenticated;\n-- UPDATE privilege is intentionally limited to mutable columns. In particular,\n-- org_id and owner_id cannot be named in client UPDATE statements.\nREVOKE UPDATE ON TABLE public.records FROM anon, authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE FUNCTION public.is_org_editor(check_org uuid, check_user uuid)\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = check_org\n      AND m.user_id = check_user\n      AND m.access = 'editor'\n  )\n$$;\nREVOKE ALL ON FUNCTION public.is_org_editor(uuid, uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_org_editor(uuid, uuid) TO authenticated;\n\nCREATE POLICY records_public_read\n  ON public.records FOR SELECT TO anon, authenticated\n  USING (true);\n\nCREATE POLICY records_editor_insert\n  ON public.records FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND public.is_org_editor(records.org_id, (SELECT auth.uid()))\n  );\n\nCREATE POLICY records_editor_update\n  ON public.records FOR UPDATE TO authenticated\n  USING (\n    public.is_org_editor(records.org_id, (SELECT auth.uid()))\n  )\n  WITH CHECK (\n    public.is_org_editor(records.org_id, (SELECT auth.uid()))\n  );\n\nCREATE POLICY records_editor_delete\n  ON public.records FOR DELETE TO authenticated\n  USING (\n    public.is_org_editor(records.org_id, (SELECT auth.uid()))\n  );\n\nCREATE INDEX memberships_user_org_access_idx\n  ON public.memberships (user_id, org_id, access);\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "b15e4a6d01956a819c387b7bfad7f22b744f4115963e43fdf1876591db721cfb",
          "sql": "BEGIN;\n\nDROP POLICY records_public_read ON public.records;\n\nCREATE POLICY records_published_public_read\n  ON public.records FOR SELECT TO anon\n  USING (published IS TRUE);\n\nCREATE POLICY records_published_authenticated_read\n  ON public.records FOR SELECT TO authenticated\n  USING (\n    published IS TRUE\n    OR public.is_org_editor(records.org_id, (SELECT auth.uid()))\n  );\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 288763,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 67291
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-1-codex-skill",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "e341dd453011c31001b8058cc4cd01bf6dff6aeca5efe957cd58072a364fd97f",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 223376,
          "wholeTreeTokens": 223376,
          "usageComplete": true,
          "actorElapsedMs": 43003,
          "observedModel": null,
          "toolCommands": 8,
          "skillReadCommandObserved": true,
          "migrationSha256": "b2a083c7a75b26b20ac9ceda4d980f8749f6e9b2c0ee58fe96d757ed169b430f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "4b175fb176f2e33d701d9896b589e84b291cdc68c2fca19e4ea26d67f41a200d"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 155936,
          "wholeTreeTokens": 155936,
          "usageComplete": true,
          "actorElapsedMs": 22838,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": true,
          "migrationSha256": "4291228bc3993a1df1969edc2cb9f04cf9c3d5b5401cd9a90bee3a9a64c472ea",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "e5765910d70a4bb0436345bc9d35261cdcf5290d15909e7fcf0fc9fe718f90c0",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "b2a083c7a75b26b20ac9ceda4d980f8749f6e9b2c0ee58fe96d757ed169b430f",
          "sql": "BEGIN;\n\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\n\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\nCREATE FUNCTION private.prevent_record_identity_change()\nRETURNS trigger\nLANGUAGE plpgsql\nSET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id\n     OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'record org_id and owner_id are immutable'\n      USING ERRCODE = '42501';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\nREVOKE ALL ON FUNCTION private.prevent_record_identity_change() FROM PUBLIC;\nCREATE TRIGGER records_identity_immutable\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.prevent_record_identity_change();\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nREVOKE ALL ON TABLE public.records, public.organizations,\n  public.memberships, public.shares FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_public_read\n  ON public.records FOR SELECT TO anon, authenticated\n  USING (true);\n\nCREATE POLICY records_editor_insert\n  ON public.records FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = (SELECT auth.uid())\n    AND (SELECT private.is_org_editor(org_id))\n  );\n\nCREATE POLICY records_editor_update\n  ON public.records FOR UPDATE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)))\n  WITH CHECK ((SELECT private.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_delete\n  ON public.records FOR DELETE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "4291228bc3993a1df1969edc2cb9f04cf9c3d5b5401cd9a90bee3a9a64c472ea",
          "sql": "BEGIN;\n\nDROP POLICY records_public_read ON public.records;\n\nCREATE POLICY records_published_read\n  ON public.records FOR SELECT TO anon, authenticated\n  USING (published);\n\nCREATE POLICY records_editor_read\n  ON public.records FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 379312,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 65841
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-1-claude-skill",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "ef67580b2915d14f845e3410a41d0b4de71f55c0155aba715595bfc8a6513e30",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 283148,
          "wholeTreeTokens": 283148,
          "usageComplete": true,
          "actorElapsedMs": 84394,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": true,
          "migrationSha256": "ac842f485b9a42b18e78536d8b7a78c5fbe5f2fa26cc6b620838c14ed64ced8c",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "34f947e4417ea56f776af4043e276ed40f7ac65e413bf081e86d19b33956d387"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 71112,
          "wholeTreeTokens": 71112,
          "usageComplete": true,
          "actorElapsedMs": 30865,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "86b1e31d4bf91699582cd2174bde425eaaacee00ec139e4237db7a98b256266b",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "4a9ee9e9d7b2c13ff3db690e159542b519a71b504c94bf1c6e6a316eef4572de",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "ac842f485b9a42b18e78536d8b7a78c5fbe5f2fa26cc6b620838c14ed64ced8c",
          "sql": "-- 001: public read of records, editor-only writes scoped to organization\nBEGIN;\n\n-- Helper lives outside the exposed schema. SECURITY DEFINER lets it read\n-- memberships without granting clients any access to that table.\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = auth.uid()\n      AND m.access = 'editor'\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Index for the RLS policy lookups on records.org_id (FK column, unindexed).\nCREATE INDEX IF NOT EXISTS records_org_id_idx ON public.records (org_id);\n\n-- Immutability of org_id and owner_id. Column grants below already block\n-- clients; this trigger also guards against future grant changes.\nCREATE OR REPLACE FUNCTION private.records_protect_immutable()\nRETURNS trigger\nLANGUAGE plpgsql\nSET search_path = ''\nAS $$\nBEGIN\n  IF NEW.org_id IS DISTINCT FROM OLD.org_id\n     OR NEW.owner_id IS DISTINCT FROM OLD.owner_id THEN\n    RAISE EXCEPTION 'records.org_id and records.owner_id are immutable'\n      USING ERRCODE = '42501';\n  END IF;\n  RETURN NEW;\nEND;\n$$;\n\nDROP TRIGGER IF EXISTS records_protect_immutable ON public.records;\nCREATE TRIGGER records_protect_immutable\n  BEFORE UPDATE ON public.records\n  FOR EACH ROW EXECUTE FUNCTION private.records_protect_immutable();\n\n-- Reset every client privilege on the base tables, then grant back the minimum.\nREVOKE ALL ON TABLE public.organizations, public.memberships,\n                    public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON TABLE public.records TO authenticated;\n-- Column-level UPDATE: org_id and owner_id are not writable by clients.\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\n-- Row security. shares gets RLS with no policy and no grant: default deny.\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\n\nDROP POLICY IF EXISTS records_select_public ON public.records;\nCREATE POLICY records_select_public ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (true);\n\nDROP POLICY IF EXISTS records_insert_editor ON public.records;\nCREATE POLICY records_insert_editor ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    owner_id = auth.uid()\n    AND (SELECT private.is_org_editor(org_id))\n  );\n\nDROP POLICY IF EXISTS records_update_editor ON public.records;\nCREATE POLICY records_update_editor ON public.records\n  FOR UPDATE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)))\n  WITH CHECK ((SELECT private.is_org_editor(org_id)));\n\nDROP POLICY IF EXISTS records_delete_editor ON public.records;\nCREATE POLICY records_delete_editor ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "86b1e31d4bf91699582cd2174bde425eaaacee00ec139e4237db7a98b256266b",
          "sql": "-- 002: unpublished records become private drafts.\n-- Public/outsider/viewer readers see only published rows; editors of the\n-- owning organization see all of their organization's rows. Write rules,\n-- grants and identity immutability from 001 are unchanged.\nBEGIN;\n\nDROP POLICY IF EXISTS records_select_public ON public.records;\n\n-- Published rows are readable by anon and authenticated. Kept as its own\n-- permissive policy so anon never evaluates the membership helper.\nDROP POLICY IF EXISTS records_select_published ON public.records;\nCREATE POLICY records_select_published ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (published);\n\n-- Editors see every row in their organization, including drafts. Permissive\n-- policies are OR'd, so this adds rows and never removes the published ones.\nDROP POLICY IF EXISTS records_select_editor ON public.records;\nCREATE POLICY records_select_editor ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 354260,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 115259
    },
    {
      "phase": "lower-models-01",
      "id": "public-catalog-1-claude-baseline",
      "task": "public-catalog",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "8630cc181fb56ac15763c2e683930d85cfbd7d18a4cd23f384a2baba9ee5f59f",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,4,5",
              "expected": "1,2,3,4,5",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,3,5",
              "expected": "1,2,3,5",
              "stderr": ""
            },
            {
              "name": "other editor sees own drafts and public rows",
              "passed": true,
              "returncode": 0,
              "actual": "1,3,4",
              "expected": "1,3,4",
              "stderr": ""
            },
            {
              "name": "outsider public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "viewer_a public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "anonymous public reads",
              "passed": true,
              "returncode": 0,
              "actual": "1,3",
              "expected": "1,3",
              "stderr": ""
            },
            {
              "name": "editor may publish draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may unpublish record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor may delete own organization draft",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 34,
          "totalChecks": 34
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 328232,
          "wholeTreeTokens": 328232,
          "usageComplete": true,
          "actorElapsedMs": 106904,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": false,
          "migrationSha256": "1b3be0a040a151821ff0872a1610ff1ceb629801e58f482169a3de8b79c5cb70",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "85db7222451748dde7d68c7a7b9d8dcb58b25066f2fb6f6a5deff9dfe87fc7fc"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 109777,
          "wholeTreeTokens": 109777,
          "usageComplete": true,
          "actorElapsedMs": 42294,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "5df52d81ab7cdbfc8fc90b3599fb42015f93573320b7ab7227df1a3cf61dd5a3",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "0f892292a49cdf24e5a046f109c6c32cf65cecccc5b816e2c854ce957badb31c",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "1b3be0a040a151821ff0872a1610ff1ceb629801e58f482169a3de8b79c5cb70",
          "sql": "-- Initial access rules: public read of records, editor-only writes per organization.\n-- Runs as the table-owner migration role (migrator). Clients are anon and authenticated.\n\n-- Membership check used by record policies. It runs as the owner so clients\n-- never need any privilege on memberships. It only answers for the caller's own uid.\nCREATE FUNCTION public.is_org_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id AND m.user_id = auth.uid() AND m.access = 'editor'\n  )\n$$;\n\nREVOKE ALL ON FUNCTION public.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_org_editor(uuid) TO authenticated;\n\n-- Start from no client privileges on every table.\nREVOKE ALL ON TABLE public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\n-- Organizations and memberships: no client access. Shares: no client access, ever.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Records: public read; writes limited to editors. owner_id and org_id are immutable,\n-- so UPDATE is granted only on the editable columns.\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\n\nGRANT SELECT ON TABLE public.records TO anon, authenticated;\nGRANT INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_public_select ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (true);\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (owner_id = auth.uid() AND public.is_org_editor(org_id));\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (public.is_org_editor(org_id))\n  WITH CHECK (public.is_org_editor(org_id));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (public.is_org_editor(org_id));\n"
        },
        {
          "stage": 2,
          "sha256": "5df52d81ab7cdbfc8fc90b3599fb42015f93573320b7ab7227df1a3cf61dd5a3",
          "sql": "-- Draft visibility: unpublished records are visible only to editors of their organization.\n-- Runs as the table-owner migration role (migrator), after 001.sql.\n-- Writes and identity rules from 001 are unchanged.\n\n-- Replace the open read policy from 001 with a published-only read policy.\nDROP POLICY records_public_select ON public.records;\n\nCREATE POLICY records_public_select ON public.records\n  FOR SELECT TO anon, authenticated\n  USING (published);\n\n-- Separate policy so anon never evaluates is_org_editor (anon has no EXECUTE on it).\n-- Permissive policies combine with OR, so editors see drafts in their own organization.\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING (public.is_org_editor(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 438009,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 149198
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-2-claude-baseline",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "3d82d0037b06205554926c1d040df87a50413f307de5316e89ae68e738b84840",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 434621,
          "wholeTreeTokens": 434621,
          "usageComplete": true,
          "actorElapsedMs": 99075,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "b16cb37a15d405815b529292ce0a68a4df8966fa6488f643b6d83ccf64a8377f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "9e82ae07de1d65be3b91804b3989fcf3a20871d183ec8723f7d8d80810745aa6"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 152935,
          "wholeTreeTokens": 152935,
          "usageComplete": true,
          "actorElapsedMs": 39968,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 8,
          "skillReadCommandObserved": false,
          "migrationSha256": "fd4dafab6c139a07ae54e45a23af16c5dd314b75056cc17ed4930bf43f407a72",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "b238b5a09670240b7ad70d98cdf4d84379098718f28a8f0567d83e99a56db1fc",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "b16cb37a15d405815b529292ce0a68a4df8966fa6488f643b6d83ccf64a8377f",
          "sql": "-- Initial access rules: grants + row level security.\n-- Replayed as migrator (table owner, NOBYPASSRLS, not superuser).\n\nBEGIN;\n\n-- Private schema for helpers that must not be exposed to clients directly.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Membership lookup for policies. Runs as the owner (migrator) so clients\n-- never need SELECT on memberships. Reads only the caller's own membership.\nCREATE FUNCTION private.is_editor(p_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS\n$$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org\n      AND m.user_id = auth.uid()\n      AND m.access = 'editor'\n  )\n$$;\nREVOKE ALL ON FUNCTION private.is_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_editor(uuid) TO authenticated;\n\n-- Index supporting org-scoped policy checks on records.\nCREATE INDEX records_org_id_idx ON public.records (org_id);\n\n-- Clear all existing client grants.\nREVOKE ALL ON TABLE public.organizations, public.memberships,\n  public.records, public.shares FROM anon, authenticated;\n\n-- Organizations and memberships: no client access at all.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\n\n-- Shares: no client access at all.\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Records: editors of the owning organization only.\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\n-- org_id and owner_id are not client-updatable; id is an identity.\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_editor(org_id));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (private.is_editor(org_id) AND owner_id = auth.uid());\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (private.is_editor(org_id))\n  WITH CHECK (private.is_editor(org_id));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (private.is_editor(org_id));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "fd4dafab6c139a07ae54e45a23af16c5dd314b75056cc17ed4930bf43f407a72",
          "sql": "-- Viewer members may read their organization's records. Editors keep full\n-- access; viewers still have no INSERT/UPDATE/DELETE rights or policies.\n-- Replayed as migrator (table owner, NOBYPASSRLS, not superuser), after 001.sql.\n\nBEGIN;\n\n-- Membership lookup for the read policy. Runs as the owner (migrator) so\n-- clients never need SELECT on memberships. Reads only the caller's own membership.\nCREATE FUNCTION private.is_member(p_org uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS\n$$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org\n      AND m.user_id = auth.uid()\n      AND m.access IN ('editor','viewer')\n  )\n$$;\nREVOKE ALL ON FUNCTION private.is_member(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_member(uuid) TO authenticated;\n\n-- Editors and viewers of the owning organization may read its records.\n-- Replaces the editor-only SELECT policy; editors are a subset of members.\nDROP POLICY records_editor_select ON public.records;\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_member(org_id));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 587556,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 139043
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-2-claude-skill",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "a64c25b312a8dbaade12413e782af7cfa21f25b80f662798945459fdf5a4c8ec",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 246693,
          "wholeTreeTokens": 246693,
          "usageComplete": true,
          "actorElapsedMs": 86029,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 12,
          "skillReadCommandObserved": true,
          "migrationSha256": "55965bc93530d33b4ce2ce5bb8f66a57c851dccbafbd5b3bd7f752b214fe080f",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "8259d4ee772581fa09a69d1d5bbe1b100ca4c984e94f0e0f8e3877d80a449cc0"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 268292,
          "wholeTreeTokens": 268292,
          "usageComplete": true,
          "actorElapsedMs": 60581,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 11,
          "skillReadCommandObserved": false,
          "migrationSha256": "78f8328687b19780da643e18ee758569c472cd14996014811e6cf162efb8d0b1",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "06b4a78df1a656be740376368ad348d847280e332f856911e078a51e1e2576ce",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "55965bc93530d33b4ce2ce5bb8f66a57c851dccbafbd5b3bd7f752b214fe080f",
          "sql": "-- Access rules: only editors of an organization can touch its records.\n-- Clients (anon, authenticated) get no table ownership and no access to\n-- organizations, memberships or shares. Enforcement is by grants plus RLS.\n\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Membership check used by the policies. SECURITY DEFINER lets it read\n-- memberships without granting clients any access to that table.\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = auth.uid()\n      AND m.access = 'editor'\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Index supporting the per-row org check and the FK from records.\nCREATE INDEX IF NOT EXISTS records_org_id_idx ON public.records (org_id);\n\n-- Start from no privileges for client roles on every table.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\n-- Records: editors only. org_id and owner_id are not updatable by clients.\nGRANT SELECT, DELETE ON public.records TO authenticated;\nGRANT INSERT (id, org_id, owner_id, body, published) ON public.records TO authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nDROP POLICY IF EXISTS records_editor_select ON public.records;\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_editor(org_id));\n\nDROP POLICY IF EXISTS records_editor_insert ON public.records;\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (private.is_org_editor(org_id) AND owner_id = auth.uid());\n\nDROP POLICY IF EXISTS records_editor_update ON public.records;\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (private.is_org_editor(org_id))\n  WITH CHECK (private.is_org_editor(org_id));\n\nDROP POLICY IF EXISTS records_editor_delete ON public.records;\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (private.is_org_editor(org_id));\n"
        },
        {
          "stage": 2,
          "sha256": "78f8328687b19780da643e18ee758569c472cd14996014811e6cf162efb8d0b1",
          "sql": "-- Viewer members can read their organization's records. Writes stay editor-only.\n\n-- Any-membership check (editor or viewer) used only by the SELECT policy.\n-- Same SECURITY DEFINER pattern as is_org_editor: clients get EXECUTE on the\n-- helper, never direct access to memberships.\nCREATE OR REPLACE FUNCTION private.is_org_member(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = auth.uid()\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_member(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_member(uuid) TO authenticated;\n\n-- Replace the editor-only SELECT policy. Editors are members, so they keep\n-- read access. Viewers gain read access only. No INSERT/UPDATE/DELETE policy\n-- or grant is added for viewers.\nDROP POLICY IF EXISTS records_editor_select ON public.records;\nDROP POLICY IF EXISTS records_member_select ON public.records;\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_member(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 514985,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 146610
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-2-codex-baseline",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "ed91af1406cb529735ed6ceac7df9b7c56ee2f8997297b2239cd61b99330c3f9",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 155459,
          "wholeTreeTokens": 155459,
          "usageComplete": true,
          "actorElapsedMs": 44702,
          "observedModel": null,
          "toolCommands": 6,
          "skillReadCommandObserved": false,
          "migrationSha256": "0193cd323879d82c95e9a81b0acfba3c7ba22ccac140c1c3d51b7bd580189148",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "e92f42bd9ebc84298f15b47376b304124cc29dcd368fac320f4711c4cdca614b"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 99874,
          "wholeTreeTokens": 99874,
          "usageComplete": true,
          "actorElapsedMs": 21899,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "104a24d2a9022dc3a195a580440fd744e1b440cdfa886eec4f32fb88cca50c65",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "edf032fc701300c0bb49328b4c3a1caeaca246f21fce3fbabe51286dd18c819f",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "0193cd323879d82c95e9a81b0acfba3c7ba22ccac140c1c3d51b7bd580189148",
          "sql": "-- Clients receive access only to records, filtered by editor membership.\nREVOKE ALL ON TABLE public.organizations, public.memberships, public.records, public.shares FROM PUBLIC, anon, authenticated;\n\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\n\n-- Read membership facts as the table owner, since clients have no access to\n-- the memberships table. The fixed search_path prevents object shadowing.\nCREATE FUNCTION public.is_org_editor(target_org uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog, public, auth\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = target_org\n      AND m.user_id = auth.uid()\n      AND m.access = 'editor'\n  )\n$$;\n\nREVOKE ALL ON FUNCTION public.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_org_editor(uuid) TO authenticated;\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT public.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT public.is_org_editor(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING ((SELECT public.is_org_editor(org_id)))\n  WITH CHECK ((SELECT public.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT public.is_org_editor(org_id)));\n"
        },
        {
          "stage": 2,
          "sha256": "104a24d2a9022dc3a195a580440fd744e1b440cdfa886eec4f32fb88cca50c65",
          "sql": "-- Viewer and editor members may read records in their organization.\n-- Keep editor-only checks for every write policy from 001.sql.\nCREATE FUNCTION public.is_org_member(target_org uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog, public, auth\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = target_org\n      AND m.user_id = auth.uid()\n      AND m.access IN ('editor', 'viewer')\n  )\n$$;\n\nREVOKE ALL ON FUNCTION public.is_org_member(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION public.is_org_member(uuid) TO authenticated;\n\nDROP POLICY records_editor_select ON public.records;\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT public.is_org_member(org_id)));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 255333,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 66601
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-2-codex-skill",
      "task": "tenant-records",
      "repeat": 2,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "e92d1ed92dd26b63d97004b9fd7e5c4d20d132c861ebdecf4abab1f2dc447cf9",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 90555,
          "wholeTreeTokens": 90555,
          "usageComplete": true,
          "actorElapsedMs": 23777,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "4e7665560f5d364adbafdab150b25d1c911fb928ce0e61f7a1e472e08f21c515",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "07b8c550dc0223da63f394c08c51bb32a652ffab8ae9a6a0ba0bf5db7e390a21"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 119035,
          "wholeTreeTokens": 119035,
          "usageComplete": true,
          "actorElapsedMs": 41182,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "73eef34413d481b9bd0e718216517128c1c49a1b35e4ba409ee89a481ca2fef4",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1082b687163772fcdd9f32218a988fad142a4734e27c5a8c5cf7d42f8caa9f10",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "4e7665560f5d364adbafdab150b25d1c911fb928ce0e61f7a1e472e08f21c515",
          "sql": "BEGIN;\n\n-- Clients have no direct access to organization or membership facts, or shares.\nREVOKE ALL ON TABLE public.organizations, public.memberships, public.shares\n  FROM PUBLIC, anon, authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nREVOKE ALL ON TABLE public.records FROM PUBLIC, anon, authenticated;\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\n-- Identity and tenant columns are immutable through the client API.\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$function$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\nCREATE INDEX memberships_editor_org_user_idx\n  ON public.memberships (org_id, user_id)\n  WHERE access = 'editor';\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT private.is_org_editor(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)))\n  WITH CHECK ((SELECT private.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "73eef34413d481b9bd0e718216517128c1c49a1b35e4ba409ee89a481ca2fef4",
          "sql": "BEGIN;\n\nCREATE FUNCTION private.is_org_record_reader(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = pg_catalog\nAS $function$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access IN ('editor', 'viewer')\n  );\n$function$;\nREVOKE ALL ON FUNCTION private.is_org_record_reader(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_org_record_reader(uuid) TO authenticated;\n\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_record_reader(org_id)));\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 209590,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 64959
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-1-claude-baseline",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "claude",
      "arm": "baseline",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "5cfb738756adfa91516a95fbd7b636f954cd608263c39729a833803e988aa022",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 403364,
          "wholeTreeTokens": 403364,
          "usageComplete": true,
          "actorElapsedMs": 97014,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 13,
          "skillReadCommandObserved": false,
          "migrationSha256": "24654435961904a35e15d3bdf9ce4eab34ec3284d3d62dbd07ee63e707041de8",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "b228ba7e504266a3b0104a4f6ccf0fe41c1f6f6a865e22379b8ea1d9080697c7"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 269067,
          "wholeTreeTokens": 269067,
          "usageComplete": true,
          "actorElapsedMs": 60525,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 9,
          "skillReadCommandObserved": false,
          "migrationSha256": "3ddf67ebe81b81423d2fef540637e638a18d1217d489572821f0b0beb5d7940a",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "1203c02236813222f69f9b40c8245cb7d24cd45911f8df9a08b867b5eab33321",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "24654435961904a35e15d3bdf9ce4eab34ec3284d3d62dbd07ee63e707041de8",
          "sql": "-- Initial access rules: RLS on organizations/memberships/records/shares.\n-- Runs as migrator (table owner, NOBYPASSRLS, not superuser).\n\n-- Helper schema is not exposed to clients beyond EXECUTE on one function.\nCREATE SCHEMA IF NOT EXISTS private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Editor check. SECURITY DEFINER (owner migrator, a table owner that does not\n-- FORCE RLS) so policies on records do not need SELECT on memberships and the\n-- membership table is never exposed to clients. search_path is pinned.\nCREATE OR REPLACE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = auth.uid()\n      AND m.access = 'editor'\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Lookup index for the per-row org check on records.\nCREATE INDEX IF NOT EXISTS records_org_id_idx ON public.records (org_id);\n\n-- Start from no client privileges on every table in public.\nREVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC, anon, authenticated;\n\n-- Enable RLS everywhere. Tables without grants or policies for clients\n-- (organizations, memberships, shares) are default-deny.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships   ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records       ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares        ENABLE ROW LEVEL SECURITY;\n\n-- Records: authenticated only. Column-level UPDATE excludes org_id and owner_id,\n-- so clients cannot move a record or reassign its owner.\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (id, body, published) ON public.records TO authenticated;\n\nCREATE POLICY records_select_editor ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_editor(org_id));\n\nCREATE POLICY records_insert_editor ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (private.is_org_editor(org_id) AND owner_id = auth.uid());\n\nCREATE POLICY records_update_editor ON public.records\n  FOR UPDATE TO authenticated\n  USING (private.is_org_editor(org_id))\n  WITH CHECK (private.is_org_editor(org_id));\n\nCREATE POLICY records_delete_editor ON public.records\n  FOR DELETE TO authenticated\n  USING (private.is_org_editor(org_id));\n"
        },
        {
          "stage": 2,
          "sha256": "3ddf67ebe81b81423d2fef540637e638a18d1217d489572821f0b0beb5d7940a",
          "sql": "-- Viewer members can SELECT their organization's records. Writes stay editor-only.\n-- Runs as migrator (table owner, NOBYPASSRLS, not superuser) after 001.sql.\n\n-- Membership check for any access level. SECURITY DEFINER like is_org_editor so\n-- the memberships table never needs client grants; search_path is pinned.\nCREATE OR REPLACE FUNCTION private.is_org_member(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = auth.uid()\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_member(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_member(uuid) TO authenticated;\n\n-- Replace the editor-only SELECT policy. INSERT/UPDATE/DELETE policies and\n-- the column-level UPDATE grant are unchanged, so viewers cannot write.\nDROP POLICY IF EXISTS records_select_editor ON public.records;\nDROP POLICY IF EXISTS records_select_member ON public.records;\n\nCREATE POLICY records_select_member ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_member(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 672431,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 157539
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-1-claude-skill",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "claude",
      "arm": "skill",
      "requestedModel": "claude-haiku-5-5",
      "cliVersion": "2.1.310 (Claude Code)",
      "modelIdentity": "observed",
      "policy": "uncapped",
      "resultSha256": "6bc845b7038c6db8fd4458cc9d7c56bc6a27d08f4fe41f8c3662566cbc0321b4",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 357348,
          "wholeTreeTokens": 357348,
          "usageComplete": true,
          "actorElapsedMs": 122049,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 14,
          "skillReadCommandObserved": true,
          "migrationSha256": "6699964188b9a5cbd6711caf7bf28674cd1ae6e95f1ce300ca21634aabea8704",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "2b4b2825671d57cde4eee676cbfad0fa2884738acb8480e53f78fc6241e479c7"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 187527,
          "wholeTreeTokens": 187527,
          "usageComplete": true,
          "actorElapsedMs": 49887,
          "observedModel": "claude-haiku-5-5",
          "toolCommands": 10,
          "skillReadCommandObserved": false,
          "migrationSha256": "ec7e08b51c27f8d13e7fbd55f8a8d669229dfebcfb8e8d0e00fa4f6c31967a07",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "4e609edc27c73f2963535b3c68cb26090f3c496207e0ecc6feadd68786f8edca",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "6699964188b9a5cbd6711caf7bf28674cd1ae6e95f1ce300ca21634aabea8704",
          "sql": "-- 001: row-level access for organization editors.\n-- Clients (anon, authenticated) get no direct access to organizations,\n-- memberships or shares. Records are reachable only by editors of the\n-- record's organization, enforced by grants plus RLS policies.\n\n-- Helper lives outside the exposed schema. SECURITY DEFINER lets it read\n-- memberships without granting clients any access to that table.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_org_editor(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id AND m.user_id = auth.uid() AND m.access = 'editor'\n  )\n$$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Index for the per-row org check in records policies.\nCREATE INDEX records_org_id_idx ON public.records (org_id);\n\n-- Grants: start from nothing for client roles.\nREVOKE ALL ON public.organizations, public.memberships, public.records, public.shares\n  FROM PUBLIC, anon, authenticated;\n\n-- Records: editors only. org_id and owner_id are never updatable by clients,\n-- so UPDATE is granted per column and excludes them (and the id key).\nGRANT SELECT, INSERT, DELETE ON public.records TO authenticated;\nGRANT UPDATE (body, published) ON public.records TO authenticated;\n\n-- RLS on every table in the exposed schema. organizations, memberships and\n-- shares have no policies, so non-owner roles see and change nothing.\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_editor(org_id));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (owner_id = (SELECT auth.uid()) AND private.is_org_editor(org_id));\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING (private.is_org_editor(org_id))\n  WITH CHECK (private.is_org_editor(org_id));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING (private.is_org_editor(org_id));\n"
        },
        {
          "stage": 2,
          "sha256": "ec7e08b51c27f8d13e7fbd55f8a8d669229dfebcfb8e8d0e00fa4f6c31967a07",
          "sql": "-- 002: viewer members can read their organization's records.\n-- Viewers get SELECT only; INSERT/UPDATE/DELETE stay editor-only, and\n-- clients still get no access to organizations, memberships or shares.\n\n-- Membership check for any access level. Same shape as is_org_editor:\n-- SECURITY DEFINER so it can read memberships without granting clients\n-- any access to that table, and it only ever answers for auth.uid().\nCREATE FUNCTION private.is_org_member(p_org_id uuid) RETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1 FROM public.memberships m\n    WHERE m.org_id = p_org_id AND m.user_id = auth.uid()\n  )\n$$;\nREVOKE ALL ON FUNCTION private.is_org_member(uuid) FROM PUBLIC;\nGRANT EXECUTE ON FUNCTION private.is_org_member(uuid) TO authenticated;\n\n-- Replace the editor-only SELECT policy. Editors are members, so they keep\n-- read access; viewers now get it too. Write policies are unchanged.\nDROP POLICY records_editor_select ON public.records;\n\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING (private.is_org_member(org_id));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 544875,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 171936
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-1-codex-skill",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "codex",
      "arm": "skill",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "7e4fce8c23e44033bcda355c0e39417ae5b1b1075cfa17b1d341d24efd0ee22e",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 99230,
          "wholeTreeTokens": 99230,
          "usageComplete": true,
          "actorElapsedMs": 24316,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": true,
          "migrationSha256": "1416d7eadcc32af0000a499171da083313e12b20c960cf67c6d7c6030c321c51",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "df02e63cb7bffe7ea516fc6784262763e88ea82ca109765ee304c6abc987a229"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 111383,
          "wholeTreeTokens": 111383,
          "usageComplete": true,
          "actorElapsedMs": 23496,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": true,
          "migrationSha256": "e4c444b7cc1adde694a70408e3865da85913071babc03f299f3c973fb467e94e",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "d1bc2e3bf99a0bb0619c13a9d43da277f9e0459aab8ff11756e8731dbd89de22",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "1416d7eadcc32af0000a499171da083313e12b20c960cf67c6d7c6030c321c51",
          "sql": "BEGIN;\n\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\n-- Read the authoritative membership fact as the non-client migration owner.\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  );\n$$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\n-- Clients have no access to organization metadata, membership facts, or shares.\nREVOKE ALL ON TABLE public.organizations, public.memberships, public.shares\n  FROM PUBLIC, anon, authenticated;\nALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\n-- Records are directly accessible only through the authenticated editor policies.\nREVOKE ALL ON TABLE public.records FROM PUBLIC, anon, authenticated;\nGRANT SELECT, DELETE ON TABLE public.records TO authenticated;\nGRANT INSERT (id, org_id, owner_id, body, published) ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT private.is_org_editor(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)))\n  WITH CHECK ((SELECT private.is_org_editor(org_id)));\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCREATE INDEX memberships_user_org_access_idx\n  ON public.memberships (user_id, org_id, access);\n\nCOMMIT;\n"
        },
        {
          "stage": 2,
          "sha256": "e4c444b7cc1adde694a70408e3865da85913071babc03f299f3c973fb467e94e",
          "sql": "BEGIN;\n\n-- Expand record visibility to viewers while keeping writes editor-only.\nCREATE OR REPLACE FUNCTION private.is_org_record_reader(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access IN ('editor', 'viewer')\n  );\n$$;\nREVOKE ALL ON FUNCTION private.is_org_record_reader(uuid) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION private.is_org_record_reader(uuid) TO authenticated;\n\nDROP POLICY records_editor_select ON public.records;\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_record_reader(org_id)));\n\n-- Keep shares inaccessible even if prior grants or policies are present.\nREVOKE ALL ON TABLE public.shares FROM PUBLIC, anon, authenticated;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nCOMMIT;\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 210613,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 47812
    },
    {
      "phase": "lower-models-01",
      "id": "tenant-records-1-codex-baseline",
      "task": "tenant-records",
      "repeat": 1,
      "harness": "codex",
      "arm": "baseline",
      "requestedModel": "gpt-6-luna",
      "cliVersion": "codex-cli 0.164.0",
      "modelIdentity": "requested-only",
      "policy": "uncapped",
      "resultSha256": "d56254edbb20bbe73d20076884ddb94aaa7743f7824a711b7cec9285107cd71d",
      "protocolHash": "16b37a4eef3c14f2cd60d4c58e4862a9ad68eabeb8da8c23f0954a03a8dd5b1c",
      "frozenStrictSuccess": true,
      "sensitivityStrictSuccess": true,
      "frozenGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  new row violates row-level security policy for table \"records\"\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table records\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table memberships\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table organizations\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  permission denied for table shares\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityGrades": [
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer has no initial read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        },
        {
          "passed": true,
          "migrationApplied": true,
          "checks": [
            {
              "name": "editor sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "other tenant sees own organization",
              "passed": true,
              "returncode": 0,
              "actual": "3,4",
              "expected": "3,4",
              "stderr": ""
            },
            {
              "name": "viewer reads own organization",
              "passed": true,
              "returncode": 0,
              "actual": "1,2,5",
              "expected": "1,2,5",
              "stderr": ""
            },
            {
              "name": "editor update owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete owner_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor update editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor delete editor_a",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "viewer cannot edit",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "viewer cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "outsider has no read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "anonymous cannot read",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot update",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "anonymous cannot delete",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "missing identity cannot read",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "missing identity cannot update",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "missing identity cannot delete",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "editor inserts own record",
              "passed": true,
              "returncode": 0,
              "actual": "1",
              "expected": "1",
              "stderr": ""
            },
            {
              "name": "editor cannot insert into other tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "editor cannot forge owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "viewer cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "outsider cannot insert",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
            },
            {
              "name": "cannot update foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot delete foreign tenant",
              "passed": true,
              "returncode": 0,
              "actual": "0",
              "expected": "refused or zero rows",
              "stderr": ""
            },
            {
              "name": "cannot move existing record to another tenant",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "cannot reassign existing owner",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "owner_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "viewer_a cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot self-promote",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "outsider cannot alter organizations",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "shares remain private",
              "passed": true,
              "returncode": 3,
              "actual": "",
              "expected": "refused or zero rows",
              "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
            },
            {
              "name": "role attributes, membership, truncate and original data preserved",
              "passed": true,
              "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
            },
            {
              "name": "all starting rows preserved exactly",
              "passed": true
            }
          ],
          "passedChecks": 36,
          "totalChecks": 36
        }
      ],
      "sensitivityChangedChecks": [],
      "replayExactMatch": true,
      "sessions": [
        {
          "stage": 1,
          "status": "completed",
          "error": null,
          "tokens": 87814,
          "wholeTreeTokens": 87814,
          "usageComplete": true,
          "actorElapsedMs": 23439,
          "observedModel": null,
          "toolCommands": 4,
          "skillReadCommandObserved": false,
          "migrationSha256": "e1caedbc6f0c814e736639222b4b7c2336df2c0bd3131e98586295f1fd9282be",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "09468895b6de6979e144b2c05f1a7a0daa3471a5fd8df3d871cd67dda240949a"
        },
        {
          "stage": 2,
          "status": "completed",
          "error": null,
          "tokens": 123913,
          "wholeTreeTokens": 123913,
          "usageComplete": true,
          "actorElapsedMs": 34130,
          "observedModel": null,
          "toolCommands": 5,
          "skillReadCommandObserved": false,
          "migrationSha256": "cb9affed687af582cd8dd759e8c7f70e36c47a0f6b01108186d5ceabc8577424",
          "tokenScope": "native aggregate including cached input; delegation disabled; supervisor effort separate",
          "inherited": false,
          "receiptSha256": "a92e9a951553a8116a4f539b8397ac5549b95f06be3c43e43740317fcf6dd5ff",
          "priorMigrationUnchanged": true
        }
      ],
      "migrations": [
        {
          "stage": 1,
          "sha256": "e1caedbc6f0c814e736639222b4b7c2336df2c0bd3131e98586295f1fd9282be",
          "sql": "-- Client access is limited to editor members of each record's organization.\nCREATE SCHEMA private;\nREVOKE ALL ON SCHEMA private FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA private TO authenticated;\n\nCREATE FUNCTION private.is_org_editor(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access = 'editor'\n  )\n$$;\nREVOKE ALL ON FUNCTION private.is_org_editor(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_org_editor(uuid) TO authenticated;\n\nCREATE INDEX memberships_user_org_access_idx\n  ON public.memberships (user_id, org_id, access);\n\nALTER TABLE public.records ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.shares ENABLE ROW LEVEL SECURITY;\n\nREVOKE ALL ON TABLE public.records, public.shares FROM PUBLIC, anon, authenticated;\nGRANT SELECT, INSERT, DELETE ON TABLE public.records TO authenticated;\nGRANT UPDATE (body, published) ON TABLE public.records TO authenticated;\n\nCREATE POLICY records_editor_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_insert ON public.records\n  FOR INSERT TO authenticated\n  WITH CHECK (\n    (SELECT private.is_org_editor(org_id))\n    AND owner_id = (SELECT auth.uid())\n  );\n\nCREATE POLICY records_editor_update ON public.records\n  FOR UPDATE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)))\n  WITH CHECK ((SELECT private.is_org_editor(org_id)));\n\nCREATE POLICY records_editor_delete ON public.records\n  FOR DELETE TO authenticated\n  USING ((SELECT private.is_org_editor(org_id)));\n"
        },
        {
          "stage": 2,
          "sha256": "cb9affed687af582cd8dd759e8c7f70e36c47a0f6b01108186d5ceabc8577424",
          "sql": "-- Viewer members may read records in their organization. Writes remain editor-only.\nCREATE FUNCTION private.is_org_member(p_org_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\nSET search_path = ''\nAS $$\n  SELECT EXISTS (\n    SELECT 1\n    FROM public.memberships AS m\n    WHERE m.org_id = p_org_id\n      AND m.user_id = (SELECT auth.uid())\n      AND m.access IN ('editor', 'viewer')\n  )\n$$;\n\nREVOKE ALL ON FUNCTION private.is_org_member(uuid) FROM PUBLIC, anon;\nGRANT EXECUTE ON FUNCTION private.is_org_member(uuid) TO authenticated;\n\nDROP POLICY records_editor_select ON public.records;\nCREATE POLICY records_member_select ON public.records\n  FOR SELECT TO authenticated\n  USING ((SELECT private.is_org_member(org_id)));\n"
        }
      ],
      "completeTwoStages": true,
      "stageDisposition": "both sessions recorded",
      "newSessionTokens": 211727,
      "newSessionUnknownUsage": 0,
      "newSessionElapsedMs": 57569
    }
  ],
  "uniqueFinalTrajectories": 48,
  "recordedCodingSessions": 96,
  "knownCodingTokens": 17338869,
  "unknownCodingUsageSessions": 0,
  "actorElapsedMs": 7154418,
  "setup": {
    "sessions": [
      {
        "phase": "continuation-uncapped-01",
        "harness": "claude",
        "arm": "baseline",
        "status": "completed",
        "tokens": 12775,
        "usageComplete": true,
        "actorElapsedMs": 6785,
        "error": null,
        "receiptSha256": "f5e381ddb359ed88d88b0f7fc5fd2a59648beb67d30f805d93e37a26b99a75ce"
      },
      {
        "phase": "continuation-uncapped-01",
        "harness": "claude",
        "arm": "skill",
        "status": "completed",
        "tokens": 14934,
        "usageComplete": true,
        "actorElapsedMs": 7990,
        "error": null,
        "receiptSha256": "4e7af58b37795158f49084bc18299281b277f6713d8f6d32ce9441e5c05071c9"
      },
      {
        "phase": "continuation-uncapped-01",
        "harness": "codex",
        "arm": "baseline",
        "status": "completed",
        "tokens": 35728,
        "usageComplete": true,
        "actorElapsedMs": 18732,
        "error": null,
        "receiptSha256": "bff5830a8b09cad75868c19a9e0b27138b3ea35fe91338bbd1fc469baac8ddb2"
      },
      {
        "phase": "continuation-uncapped-01",
        "harness": "codex",
        "arm": "skill",
        "status": "completed",
        "tokens": 37296,
        "usageComplete": true,
        "actorElapsedMs": 18299,
        "error": null,
        "receiptSha256": "f186935e7dd76764da45b37c370fc6c539c133dea6b4d963eacd65e79d591ed7"
      },
      {
        "phase": "lower-models-01",
        "harness": "claude",
        "arm": "baseline",
        "status": "completed",
        "tokens": 6391,
        "usageComplete": true,
        "actorElapsedMs": 4030,
        "error": null,
        "receiptSha256": "1f3585528d6ee41df15045ca136682784bfdd992c25d95aecafacfa892968adf"
      },
      {
        "phase": "lower-models-01",
        "harness": "claude",
        "arm": "skill",
        "status": "completed",
        "tokens": 12202,
        "usageComplete": true,
        "actorElapsedMs": 5291,
        "error": null,
        "receiptSha256": "e382f1c4116b454d10f2b89e39b9152d232afde69c4e597f21a0b87159befcd6"
      },
      {
        "phase": "lower-models-01",
        "harness": "codex",
        "arm": "baseline",
        "status": "completed",
        "tokens": 24635,
        "usageComplete": true,
        "actorElapsedMs": 8597,
        "error": null,
        "receiptSha256": "f54c2ebca01199a55a275f653c67f8cb5d5958b4a9a4918aaedf0d8150408d32"
      },
      {
        "phase": "lower-models-01",
        "harness": "codex",
        "arm": "skill",
        "status": "completed",
        "tokens": 25378,
        "usageComplete": true,
        "actorElapsedMs": 8418,
        "error": null,
        "receiptSha256": "9eb100415f26b96b2617ded722d4bf8378381cf878bf98057bc01642b879da9d"
      },
      {
        "phase": "pilot-02",
        "harness": "claude",
        "arm": "baseline",
        "status": "completed",
        "tokens": 8666,
        "usageComplete": true,
        "actorElapsedMs": 5899,
        "error": null,
        "receiptSha256": "0418149e0d2f9b2cbc70ee56135f16dd1f45b18719f670ccea7fc003aa739ecb"
      },
      {
        "phase": "pilot-02",
        "harness": "claude",
        "arm": "skill",
        "status": "completed",
        "tokens": 14897,
        "usageComplete": true,
        "actorElapsedMs": 8319,
        "error": null,
        "receiptSha256": "252d27e0d481688d20d2d4f73acf8b22e2c88507e84e3a8d08676d9620220af6"
      },
      {
        "phase": "pilot-02",
        "harness": "codex",
        "arm": "baseline",
        "status": "completed",
        "tokens": 25999,
        "usageComplete": true,
        "actorElapsedMs": 10958,
        "error": null,
        "receiptSha256": "8d3ad6f3c9a412a05cf4921582c6bf93a0544f4c81ccfbe6db21bc9d59d40895"
      },
      {
        "phase": "pilot-02",
        "harness": "codex",
        "arm": "skill",
        "status": "completed",
        "tokens": 30292,
        "usageComplete": true,
        "actorElapsedMs": 11439,
        "error": null,
        "receiptSha256": "a38d8c7c1e0853a7402725650f08ed9ee3d246171eb4cc3a8a583a157679fdfd"
      },
      {
        "phase": "pilot-03",
        "harness": "claude",
        "arm": "baseline",
        "status": "completed",
        "tokens": 8667,
        "usageComplete": true,
        "actorElapsedMs": 7144,
        "error": null,
        "receiptSha256": "1291045eef457907ddcf8d60f29b0ac24bc0963cb0e91cd94349b6e7c33f5f2f"
      },
      {
        "phase": "pilot-03",
        "harness": "claude",
        "arm": "skill",
        "status": "completed",
        "tokens": 9707,
        "usageComplete": true,
        "actorElapsedMs": 8207,
        "error": null,
        "receiptSha256": "49d25bde916f345861697a0fd6109eb97df9853d2670978b180518f26a73be72"
      },
      {
        "phase": "pilot-03",
        "harness": "codex",
        "arm": "baseline",
        "status": "completed",
        "tokens": 26648,
        "usageComplete": true,
        "actorElapsedMs": 10520,
        "error": null,
        "receiptSha256": "432c31a037825a64f8c63d25b7a8f182da5b5331f9145aaf351fff3b1d1d1138"
      },
      {
        "phase": "pilot-03",
        "harness": "codex",
        "arm": "skill",
        "status": "completed",
        "tokens": 37424,
        "usageComplete": true,
        "actorElapsedMs": 14193,
        "error": null,
        "receiptSha256": "042405f7ea5aaaa1caee2321786083102c7a35008b13e7127883b8e521db385a"
      }
    ],
    "knownTokens": 331639,
    "unknownUsageSessions": 0,
    "actorElapsedMs": 154821,
    "coverage": "All retained smoke session receipts, including failed earlier preparations. Model-free checker work separate. Supervisor effort unknown."
  },
  "captureIsolation": {
    "status": "PASS",
    "checkedAt": "2026-10-27T04:06:53.472Z",
    "checkedSessionCount": 112,
    "ingestedMatches": 0
  },
  "supervisorTokens": null,
  "deliveryAudit": {
    "treatmentSessions": 48,
    "skillTextReturnedSessions": 47,
    "unverifiedReads": [
      {
        "phase": "pilot-03",
        "id": "public-catalog-2-claude-skill",
        "stage": 2,
        "skillTextReturned": false
      }
    ]
  },
  "sensitivity": {
    "protocol": {
      "format": "rulemetric-supabase-posthoc-sensitivity-v2",
      "createdAt": "2026-10-27T03:09:30.230115+00:00",
      "status": "post-hoc corrected replay; primary outcomes unchanged",
      "supersedes": {
        "protocolSha256": "f4ad2399d8236d037ef5f43d0d3a0a0b037c7ace1daadf299273b3d86b8c552b",
        "reason": "First sensitivity accepted only default P0001. Verbose replay found valid custom triggers also use explicit insufficient_privilege 42501 and check_violation 23514. First sensitivity records retained."
      },
      "scope": "Only the two owner/org immutability probes additionally accept SQLSTATE P0001,42501,23514 when PostgreSQL reports PL/pgSQL at RAISE. All permitted operations and other assertions unchanged. Invalid syntax, division-by-zero and unconditional denial still fail. No actor reruns.",
      "sourceHashes": {
        "grader.py": "3f5625746f70dbb2ef7dd006c57abb569fb473fbb4fa98a6e2b477289a7a845d",
        "database.py": "4841c172a28a56f203d54b989af054c0efd629c43988ad30372d96df754ea7f7",
        "__init__.py": "ed3b61a97c9741f9862614bc18c8b634239b0f18b31b02820985432c488afe55",
        "fixtures.py": "13e04472c6fffbaa0712a6eaa625845d690c453d274050c29c9111a0e27f148a"
      },
      "validation": "27 original controls; conditional trigger using P0001,42501,23514 at both stages across all three families (18); removed guard, always raise, division-by-zero, explicit RAISE 22012 across each family (12). Total57."
    },
    "protocolSha256": "6fce1dd2515d4687f120b3343919f3ec11812982af43528538eda8bc9243a082",
    "qualification": {
      "protocolSha256": "6fce1dd2515d4687f120b3343919f3ec11812982af43528538eda8bc9243a082",
      "controls": [
        {
          "task": "tenant-records",
          "label": "original-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer has no initial read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "original-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "disabled-record-rls",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": false,
                "returncode": 0,
                "actual": "5",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": false,
                "returncode": 0,
                "actual": "5",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 18,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "deny-all",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,2,5",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "other tenant sees own organization",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "3,4",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer reads own organization",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,2,5",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor update owner_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor delete owner_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor update editor_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor delete editor_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor inserts own record",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 28,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "missing-insert-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 31,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "missing-identity-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "truncate-granted",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nf\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 35,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "destructive-hiding",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": false,
                "returncode": 0,
                "actual": "1,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": false,
                "returncode": 0,
                "actual": "1,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nt\n1:Acme published,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": false
              }
            ],
            "passedChecks": 32,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "old-policy-left-behind",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": false,
                "returncode": 0,
                "actual": "",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 35,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-P0001-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer has no initial read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-P0001-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-42501-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer has no initial read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-42501-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-23514-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer has no initial read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "conditional-trigger-23514-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 36,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "removed-identity-trigger",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 35,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "always-raise-denies-valid-update",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "broken-trigger-division-by-zero",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "tenant-records",
          "label": "explicit-wrong-raise-code",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "other tenant sees own organization",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "viewer reads own organization",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,5",
                "expected": "1,2,5",
                "stderr": ""
              },
              {
                "name": "editor update owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete owner_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor update editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor delete editor_a",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider has no read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 36
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "original-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 41
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "original-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 43,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "disabled-record-rls",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": false,
                "actual": "1",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": false,
                "actual": "1",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": false,
                "returncode": 0,
                "actual": "5",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 22,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "deny-all",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,2",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "other owner isolated",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "3,4",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "recipient receives only selected shares",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "unshared editor sees own document only",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "5",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner updates own document",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner deletes own unshared document",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": false,
                "actual": "",
                "stderr": "ERROR:  permission denied for table records\n"
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": false,
                "actual": "",
                "stderr": "ERROR:  permission denied for table records\n"
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor inserts own record",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "missing-insert-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 38,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "missing-identity-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "truncate-granted",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nf\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 42,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "destructive-hiding",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": false,
                "returncode": 0,
                "actual": "0",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nt\n1:Acme published,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": false
              }
            ],
            "passedChecks": 38,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "old-policy-left-behind",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": false,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": false,
                "actual": "1",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-P0001-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 41
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-P0001-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 43,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-42501-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 41
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-42501-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 43,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-23514-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 41
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "conditional-trigger-23514-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 43,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "removed-identity-trigger",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 42,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "always-raise-denies-valid-update",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 42,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "broken-trigger-division-by-zero",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "document-sharing",
          "label": "explicit-wrong-raise-code",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "owner retains both documents",
                "passed": true,
                "returncode": 0,
                "actual": "1,2",
                "expected": "1,2",
                "stderr": ""
              },
              {
                "name": "other owner isolated",
                "passed": true,
                "returncode": 0,
                "actual": "3,4",
                "expected": "3,4",
                "stderr": ""
              },
              {
                "name": "recipient receives only selected shares",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "unshared editor sees own document only",
                "passed": true,
                "returncode": 0,
                "actual": "5",
                "expected": "5",
                "stderr": ""
              },
              {
                "name": "owner updates own document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner deletes own unshared document",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "peer cannot edit owner's document",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner may create share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may deactivate share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "owner may remove share",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "recipient cannot create shares",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"shares\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "recipient cannot reactivate shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot delete shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "recipient cannot inspect shares",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "immediate revocation: UPDATE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "immediate revocation: DELETE",
                "passed": true,
                "actual": "0",
                "stderr": ""
              },
              {
                "name": "anonymous cannot read",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot read",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 41,
            "totalChecks": 43
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "original-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "original-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "disabled-record-rls",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 16,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "deny-all",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,2,3,5",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,3,4",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider public reads",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,3",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a public reads",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,3",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous public reads",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1,3",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor may publish draft",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor may unpublish record",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor may delete own organization draft",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor inserts own record",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 25,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "missing-insert-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor cannot forge owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "viewer cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot insert",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 29,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "missing-identity-check",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 28,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "truncate-granted",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nf\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 33,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "destructive-hiding",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": false,
                "returncode": 0,
                "actual": "1,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": false,
                "returncode": 0,
                "actual": "0",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": false,
                "actual": "t\n0\nt\n1:Acme published,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": false
              }
            ],
            "passedChecks": 30,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "old-policy-left-behind",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": false,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 29,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-P0001-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-P0001-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-42501-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-42501-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-23514-positive-1",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,4,5",
                "expected": "1,2,3,4,5",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "conditional-trigger-23514-positive-2",
          "expected": true,
          "result": {
            "passed": true,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  23514: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 34,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "removed-identity-trigger",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 0,
                "actual": "1",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 33,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "always-raise-denies-valid-update",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "editor may unpublish record",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "1",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  P0001: Identity is immutable\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 32,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "broken-trigger-division-by-zero",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: division by zero\nCONTEXT:  SQL statement \"SELECT 1/0\"\nPL/pgSQL function protect_identity() line 4 at PERFORM\nLOCATION:  int4div, int.c:841\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 32,
            "totalChecks": 34
          },
          "passed": true
        },
        {
          "task": "public-catalog",
          "label": "explicit-wrong-raise-code",
          "expected": false,
          "result": {
            "passed": false,
            "migrationApplied": true,
            "checks": [
              {
                "name": "editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,2,3,5",
                "expected": "1,2,3,5",
                "stderr": ""
              },
              {
                "name": "other editor sees own drafts and public rows",
                "passed": true,
                "returncode": 0,
                "actual": "1,3,4",
                "expected": "1,3,4",
                "stderr": ""
              },
              {
                "name": "outsider public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "viewer_a public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "anonymous public reads",
                "passed": true,
                "returncode": 0,
                "actual": "1,3",
                "expected": "1,3",
                "stderr": ""
              },
              {
                "name": "editor may publish draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may unpublish record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor may delete own organization draft",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "viewer cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "outsider cannot edit",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "anonymous cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot update",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "anonymous cannot delete",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table records\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "missing identity cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "missing identity cannot update",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "missing identity cannot delete",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "editor inserts own record",
                "passed": true,
                "returncode": 0,
                "actual": "1",
                "expected": "1",
                "stderr": ""
              },
              {
                "name": "editor cannot insert into other tenant",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "editor cannot forge owner",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "viewer cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "outsider cannot insert",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: new row violates row-level security policy for table \"records\"\nLOCATION:  ExecWithCheckOptions, execMain.c:2158\n"
              },
              {
                "name": "cannot update foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot delete foreign tenant",
                "passed": true,
                "returncode": 0,
                "actual": "0",
                "expected": "refused or zero rows",
                "stderr": ""
              },
              {
                "name": "cannot move existing record to another tenant",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "cannot reassign existing owner",
                "passed": false,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  22012: broken helper\nCONTEXT:  PL/pgSQL function protect_identity() line 4 at RAISE\nLOCATION:  exec_stmt_raise, pl_exec.c:3911\n"
              },
              {
                "name": "owner_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "owner_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "viewer_a cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot self-promote",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table memberships\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "outsider cannot alter organizations",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table organizations\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "shares remain private",
                "passed": true,
                "returncode": 3,
                "actual": "",
                "expected": "refused or zero rows",
                "stderr": "ERROR:  42501: permission denied for table shares\nLOCATION:  aclcheck_error, aclchk.c:2843\n"
              },
              {
                "name": "role attributes, membership, truncate and original data preserved",
                "passed": true,
                "actual": "t\n0\nt\n1:Acme published,2:Acme draft,3:Birch published,4:Birch draft,5:Other editor draft"
              },
              {
                "name": "all starting rows preserved exactly",
                "passed": true
              }
            ],
            "passedChecks": 32,
            "totalChecks": 34
          },
          "passed": true
        }
      ],
      "passed": true
    },
    "qualificationSha256": "0cd63222e7799b13dca7fb56644bdee2069656241bddd1fe40b3780542cb4223",
    "label": "post-hoc corrected replay; not a new preregistered primary outcome"
  },
  "replay": {
    "status": "complete",
    "replayedResults": 49,
    "replayedStageChecks": 97,
    "mismatches": 0
  },
  "reasoning": {
    "gpt-6.1-sol": "Bundled native default low; not explicitly overridden. Served reasoning not independently attested.",
    "gpt-6-luna": "Bundled native default medium; not explicitly overridden. Served reasoning not independently attested.",
    "claude": "Native defaults; no explicit reasoning-effort override or separate served-effort attestation."
  },
  "limits": [
    "Original capped phase stopped after 17 sessions; immutable partial record retained. Uncapped continuation executes only unexposed stages.",
    "One Sonnet baseline trajectory crosses execution policies; its counterpart is excluded from matched same-policy comparisons.",
    "Custom-trigger denial correction was designed after inspecting failures. Both frozen and post-hoc scores are retained.",
    "Only three authored families with small fixture tables. No production workload, performance benchmark, hosted Auth/PostgREST, automatic skill routing, or broad security certification.",
    "Codex identity requested-only; Claude observed model checked. Native defaults and generations differ; within-model comparisons only.",
    "Cached input included in tokens. Subscriptions used; tokens and CLI list-price estimates are not incremental dollars. Supervisor tokens unknown.",
    "Assignment to supplied skill does not guarantee consumption or compliance; observed skill reads and missing read evidence are reported separately.",
    "Local work and model-free verification replays overlapped some coding sessions; elapsed totals are descriptive rather than isolated latency measurements.",
    "No optional skill was installed, removed, or adopted based on this pilot."
  ]
}