feat(e2e): run Postgres v2 migrations through the isolated harness

e2e/migration-harness/__tests__/app-host-error-frame.test.ts

@@ -0,0 +1,60 @@
+import { spawn } from 'node:child_process'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createInterface } from 'node:readline'
+import { fileURLToPath } from 'node:url'
+import { expect, test } from 'vitest'
+
+const appHost = fileURLToPath(new URL('../run/app-host.mjs', import.meta.url))
+
+// The App Host is the RPC boundary: safePostgresCause classifies an application
+// failure by its SQLSTATE, so the frame must carry an allowlisted code.
+test('App Host error frames carry an allowlisted error code and drop any other', async () => {
+  const workspace = await mkdtemp(join(tmpdir(), 'mh-app-host-frame-'))
+  try {
+    await mkdir(join(workspace, 'src'))
+    await writeFile(
+      join(workspace, 'src/stores.mjs'),
+      'export async function createStores() { return { init: async () => {}, close: async () => {} } }\n',
+    )
+    await writeFile(
+      join(workspace, 'src/app.mjs'),
+      `export async function createApp() {
+  return {
+    get: async (code) => { throw Object.assign(Error('application failure'), { code }) },
+    close: async () => {},
+  }
+}
+`,
+    )
+    const child = spawn(process.execPath, [appHost], {
+      cwd: workspace,
+      stdio: ['pipe', 'pipe', 'inherit'],
+    })
+    const lines = createInterface({ input: child.stdout })[
+      Symbol.asyncIterator
+    ]()
+    const call = async (id: number, code: string) => {
+      child.stdin.write(
+        `${JSON.stringify({ id, method: 'get', args: [code] })}\n`,
+      )
+      const { value } = await lines.next()
+      return JSON.parse(String(value))
+    }
+    expect(await call(1, '42P01')).toEqual({
+      id: 1,
+      error: 'application failure',
+      code: '42P01',
+    })
+    expect(await call(2, 'ECONNRESET')).toMatchObject({ code: 'ECONNRESET' })
+    expect(await call(3, 'ada@example.com')).toEqual({
+      id: 3,
+      error: 'application failure',
+    })
+    child.stdin.end()
+    await new Promise((resolve) => child.on('close', resolve))
+  } finally {
+    await rm(workspace, { recursive: true, force: true })
+  }
+})

e2e/migration-harness/__tests__/installed-copy-checks.test.ts

@@ -0,0 +1,136 @@
+import assert from 'node:assert/strict'
+import { cp, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'vitest'
+import { migrationChecks } from '../run/migration-checks.mjs'
+import { run } from '../run/run.mjs'
+
+const manifest = { dependencies: { '@cipherstash/stack': '1.2.1' } }
+const lock = {
+  packages: {
+    '': manifest,
+    'node_modules/@cipherstash/stack': { version: '1.2.1' },
+    'node_modules/@cipherstash/protect-ffi': { version: '0.31.0' },
+  },
+}
+
+for (const change of [
+  {
+    name: 'a Protect import',
+    path: 'src/app.mjs',
+    text: 'import "@cipherstash/protect"',
+    check: 'migration.protect-dependencies-absent',
+  },
+  {
+    name: 'a CTS endpoint shim',
+    path: 'src/app.mjs',
+    text: 'process.env.CS_CTS_HOST = "https://example.invalid"',
+    check: 'migration.endpoint-shim-absent',
+  },
+  {
+    name: 'a ZeroKMS endpoint shim',
+    path: 'src/app.mjs',
+    text: 'process.env.CS_ZEROKMS_HOST = "https://example.invalid"',
+    check: 'migration.endpoint-shim-absent',
+  },
+  {
+    name: 'a legacy manifest dependency',
+    path: 'package.json',
+    text: JSON.stringify({
+      dependencies: {
+        ...manifest.dependencies,
+        '@cipherstash/protect': '10.2.1',
+      },
+    }),
+    check: 'migration.protect-dependencies-absent',
+  },
+  {
+    name: 'a legacy lockfile dependency',
+    path: 'package-lock.json',
+    text: JSON.stringify({
+      packages: {
+        ...lock.packages,
+        'node_modules/@cipherstash/protect': { version: '10.2.1' },
+      },
+    }),
+    check: 'migration.protect-dependencies-absent',
+  },
+  {
+    name: 'a legacy FFI declaration',
+    path: 'package.json',
+    text: JSON.stringify({
+      dependencies: {
+        ...manifest.dependencies,
+        '@cipherstash/protect-ffi': '0.18.1',
+      },
+    }),
+    check: 'migration.protect-ffi-version',
+  },
+]) {
+  test(`Run rejects ${change.name} introduced in the installed App Host copy`, async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'mh-installed-checks-'))
+    const workspace = join(directory, 'migrator')
+    const installedWorkspace = join(directory, 'app-host')
+    try {
+      await mkdir(join(workspace, 'src'), { recursive: true })
+      await writeFile(join(workspace, 'package.json'), JSON.stringify(manifest))
+      await writeFile(
+        join(workspace, 'package-lock.json'),
+        JSON.stringify(lock),
+      )
+      await writeFile(
+        join(workspace, 'src/app.mjs'),
+        'import "@cipherstash/stack/v3"',
+      )
+      await cp(workspace, installedWorkspace, { recursive: true })
+      const inspect = () =>
+        migrationChecks({
+          workspace,
+          installedWorkspace,
+          stackVersion: '1.2.1',
+          ffiRange: '0.31.0',
+          mutationSnapshot: { dynamo: { Item: { active__source: 'cipher' } } },
+        })
+      assert.ok(
+        (await inspect()).every((check) => check.passed),
+        'The unchanged installed app must satisfy the migration requirements',
+      )
+      const report = await run({
+        id: 'installed-copy',
+        manifest: { guideHash: 'guide' },
+        driver: {
+          provision: async () => {},
+          installUnmigrated: async () => {},
+          initializeLegacyData: async () => {},
+          snapshot: async () => {},
+          migrate: async () => ({ exitCode: 0 }),
+          friction: async () => [],
+          installAppHost: async () => {
+            // Model a lifecycle script changing only the deployed copy.
+            await writeFile(join(installedWorkspace, change.path), change.text)
+          },
+          behaviour: async () => [
+            { id: 'no-rewrite.legacy-bytes', passed: true },
+            ...(await inspect()),
+          ],
+        },
+      })
+      assert.equal(
+        report.outcome,
+        'behaviour',
+        'A clean Migrator workspace must not hide installed-copy regressions',
+      )
+      assert.ok(
+        report.evidence.some(
+          (entry) =>
+            entry.checkId === change.check &&
+            Object(entry.payload).passed === false,
+        ),
+        `The Run must name the failed ${change.check} requirement`,
+      )
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+}

e2e/migration-harness/__tests__/isolation-regressions.test.ts

@@ -72,6 +72,40 @@ beforeEach(() => {
           live.set(args[args.indexOf('--name') + 1], { actor, child })
           return
         }
+        if (actor === 'rpc-error-probe') {
+          // Answers every App Host request with an application error frame,
+          // including requests written before this mock turn ran.
+          const answer = (line: string) => {
+            const { id, args: callArgs } = JSON.parse(line)
+            const reply = {
+              id,
+              error: 'relation does not exist',
+              code: callArgs[0],
+            }
+            child.stdout.write(
+              `${JSON.stringify({
+                kind: 'stdout',
+                data: Buffer.from(`${JSON.stringify(reply)}\n`).toString(
+                  'base64',
+                ),
+              })}\n`,
+            )
+          }
+          for (const [line] of child.stdin.write.mock.calls) answer(line)
+          child.stdin.write.mockImplementation(answer)
+          child.stdin.end.mockImplementation(() => {
+            for (const value of [
+              { kind: 'actor-exit', actor, stage: 'command', exitCode: 0 },
+              { kind: 'stream-end' },
+              { kind: 'exit', exitCode: 0 },
+            ])
+              child.stdout.write(`${JSON.stringify(value)}\n`)
+            child.stdout.end()
+            child.stderr.end()
+            child.emit('close', 0)
+          })
+          return
+        }
         const frame = (value: Record<string, unknown>) =>
           child.stdout.write(`${JSON.stringify(value)}\n`)
         if (actor === 'git-tool-probe') {
@@ -163,6 +197,30 @@ test('observer termination without an actor exit record is infrastructure even w
 
 afterEach(() => vi.clearAllMocks())
 
+test('an App Host error frame keeps an allowlisted PostgreSQL code across the RPC boundary', async () => {
+  const isolation = createIsolation()
+  await isolation.prove()
+  const host = await isolation.openAppHost({
+    actor: 'rpc-error-probe',
+    workspace: '/synthetic-workspace',
+  })
+  try {
+    const rejection = (code: string) =>
+      host.call('get', [code]).then(
+        () => null,
+        (error: Error & { code?: unknown }) => error,
+      )
+    const missing = await rejection('42P01')
+    expect(missing?.message).toBe('relation does not exist')
+    expect(missing?.code).toBe('42P01')
+    // Free-form codes are application data, not classification evidence.
+    const unexpected = await rejection('customer ada@example.com')
+    expect(unexpected).not.toHaveProperty('code')
+  } finally {
+    await host.close()
+  }
+})
+
 test('an App Host that already exited rejects later calls so the Run can report failure', async () => {
   const isolation = createIsolation()
   await isolation.prove()

e2e/migration-harness/__tests__/postgres-behaviour.test.ts

@@ -0,0 +1,56 @@
+import { expect, test } from 'vitest'
+import {
+  postgresBehaviour,
+  postgresLegacy,
+} from '../run/postgres-behaviour.mjs'
+
+test('Postgres behaviour separates read-only checks from fresh writes', async () => {
+  const rows = new Map<string, Record<string, unknown>>(
+    postgresLegacy.map((row) => [row.pk, row]),
+  )
+  const calls: string[] = []
+  const result = await postgresBehaviour(async (method, args) => {
+    calls.push(method)
+    const value = args[0]
+    if (method === 'put') {
+      const row = Object.fromEntries(Object.entries(Object(value)))
+      rows.set(String(row.pk), row)
+      return null
+    }
+    if (method === 'get') return rows.get(String(value)) ?? null
+    const column = method === 'findEmail' ? 'email' : 'age'
+    return [...rows.values()]
+      .filter((row) => row[column] === value)
+      .sort((a, b) => String(a.pk).localeCompare(String(b.pk)))
+  })
+  expect(calls).not.toContain('put')
+  expect(result.checks.every((check) => check.passed)).toBe(true)
+  expect((await result.mutate()).every((check) => check.passed)).toBe(true)
+  expect(calls).toContain('put')
+})
+
+test('Postgres behaviour identifies a query mapping that returns only one equal-age row', async () => {
+  const result = await postgresBehaviour(async (method, args) => {
+    if (method === 'get')
+      return postgresLegacy.find((row) => row.pk === args[0])
+    if (method === 'findEmail')
+      return postgresLegacy.filter((row) => row.email === args[0])
+    return postgresLegacy.filter((row) => row.age === args[0]).slice(0, 1)
+  })
+  expect(result.checks).toContainEqual(
+    expect.objectContaining({
+      id: 'behaviour.postgres-age-lookup',
+      passed: false,
+    }),
+  )
+})
+
+test('Postgres failures retain safe diagnostic codes without provider or SQL text', async () => {
+  const result = await postgresBehaviour(async () => {
+    throw Object.assign(Error('secret-sentinel in SQL or provider response'), {
+      code: '42P01',
+    })
+  })
+  expect(result.checks[0].cause).toContain('42P01')
+  expect(JSON.stringify(result.checks)).not.toContain('secret-sentinel')
+})