vignette/scripts/smoke-continuous-improvement-ledger.sql

\set ON_ERROR_STOP on

-- Reserved fixture UUID range: [14000000-0000-0000-0000-000000000000,
-- 14000000-0000-0000-0000-000000000100). Assertions under privileged roles
-- must only count rows owned by this smoke run so a populated dev DB is safe.
BEGIN;

INSERT INTO app.app_user (user_id, external_id, email, display_name, role, cohort)
VALUES
  ('14000000-0000-0000-0000-000000000001','g8-smoke-admin','g8-admin@example.invalid','G8 Admin','admin','g8-smoke'),
  ('14000000-0000-0000-0000-000000000002','g8-smoke-learner','g8-learner@example.invalid','G8 Learner','learner','g8-smoke'),
  ('14000000-0000-0000-0000-000000000003','g8-smoke-teacher','g8-teacher@example.invalid','G8 Teacher','instructor','g8-smoke');

SET LOCAL ROLE vignette;
SELECT set_config('app.ai_context','1',true);
SELECT set_config('app.current_ai_view','research',true);

-- Complete source -> draft -> independent red-team -> benchmark -> qualification.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000010',repeat('a',64),'content_pipeline',
  '14000000-0000-0000-0000-000000000019'
);
INSERT INTO app.ci_source_artifact (
  source_record_id, source_id, source_version, content_sha256, provenance_uri,
  usage_status, citation_label, content_hash
) VALUES (
  '14000000-0000-0000-0000-000000000011','oas-g8-source-smoke','1.0.0',repeat('b',64),
  'repo://synthetic/g8/source','approved','synthetic source',repeat('c',64)
);
INSERT INTO app.ci_content_pipeline (
  pipeline_id, submission_id, draft_id, content_kind, source_record_ids,
  generation_model, prompt_version, prompt_sha256, payload_sha256,
  synthetic_identity_id, difficulty_level, hidden_answer_fingerprint,
  visible_answer_overlap_tokens, pii_findings, unsupported_clinical_claims
) VALUES (
  '14000000-0000-0000-0000-000000000012','14000000-0000-0000-0000-000000000010',
  'oas-g8-draft-smoke','case','{14000000-0000-0000-0000-000000000011}',
  'content-agent','1.0.0',repeat('d',64),repeat('e',64),
  'synthetic-identity-smoke',4,repeat('f',64),0,0,0
);
INSERT INTO app.ci_red_team_review (
  review_record_id, pipeline_id, review_id, reviewer_agent_id, dimensions,
  reviewed_payload_sha256
) VALUES
  ('14000000-0000-0000-0000-000000000013','14000000-0000-0000-0000-000000000012',
   'oas-g8-review-smoke-a','red-team-a','{safety,identity,pii,grounding}',repeat('e',64)),
  ('14000000-0000-0000-0000-000000000014','14000000-0000-0000-0000-000000000012',
   'oas-g8-review-smoke-b','red-team-b','{answer_leakage,cultural_bias,difficulty}',repeat('e',64));
INSERT INTO app.ci_content_benchmark (
  benchmark_record_id, pipeline_id, benchmark_id, variant_count,
  variant_pass_rate, answer_leakage_count, pii_finding_count,
  unsupported_claim_count, safety_failure_count, reward_hacking_count,
  evidence_refs, qualified
) VALUES (
  '14000000-0000-0000-0000-000000000018','14000000-0000-0000-0000-000000000012',
  'oas-g8-benchmark-smoke',8,0.875,0,0,0,0,0,
  '{audit://synthetic/g8/benchmark}',TRUE
);
INSERT INTO app.ci_content_qualification (
  qualification_id, pipeline_id, benchmark_record_id, catalog_entry_id,
  payload_sha256, source_record_ids, review_record_ids
) VALUES (
  '14000000-0000-0000-0000-000000000019','14000000-0000-0000-0000-000000000012',
  '14000000-0000-0000-0000-000000000018','oas-g8-catalog-smoke',repeat('e',64),
  '{14000000-0000-0000-0000-000000000011}',
  '{14000000-0000-0000-0000-000000000013,14000000-0000-0000-0000-000000000014}'
);

-- Complete release evidence gate. Qualification remains pending; there is no promotion row.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000020',repeat('1',64),'release_gate',
  '14000000-0000-0000-0000-000000000021'
);
INSERT INTO app.ci_gate_artifact (
  artifact_record_id, owner_kind, owner_id, artifact_kind, artifact_id,
  content_sha256, provenance_uri
) VALUES
  ('14000000-0000-0000-0000-000000000022','release_gate','14000000-0000-0000-0000-000000000021','baseline','baseline',repeat('2',64),'repo://synthetic/g8/baseline'),
  ('14000000-0000-0000-0000-000000000023','release_gate','14000000-0000-0000-0000-000000000021','threshold','threshold',repeat('3',64),'repo://synthetic/g8/threshold'),
  ('14000000-0000-0000-0000-000000000024','release_gate','14000000-0000-0000-0000-000000000021','provenance','provenance',repeat('4',64),'audit://synthetic/g8/provenance'),
  ('14000000-0000-0000-0000-000000000025','release_gate','14000000-0000-0000-0000-000000000021','rollback','rollback',repeat('5',64),'repo://synthetic/g8/rollback');
INSERT INTO app.ci_release_gate (
  gate_id, submission_id, release_id, red_green_passed, contract_passed,
  e2e_passed, runtime_proof_passed, public_proof_passed, ssot_synced,
  evidence_refs, baseline_artifact_id, threshold_artifact_id,
  provenance_artifact_ids, rollback_artifact_id, qualified
) VALUES (
  '14000000-0000-0000-0000-000000000021','14000000-0000-0000-0000-000000000020',
  'oas-g8-release-smoke',TRUE,TRUE,TRUE,TRUE,TRUE,TRUE,
  '{audit://synthetic/g8/release}','14000000-0000-0000-0000-000000000022',
  '14000000-0000-0000-0000-000000000023','{14000000-0000-0000-0000-000000000024}',
  '14000000-0000-0000-0000-000000000025',TRUE
);

-- A missing provenance artifact fails closed before a release gate can exist.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000026',repeat('6',64),'release_gate',
  '14000000-0000-0000-0000-000000000027'
);
INSERT INTO app.ci_gate_artifact (
  artifact_record_id, owner_kind, owner_id, artifact_kind, artifact_id,
  content_sha256, provenance_uri
) VALUES
  ('14000000-0000-0000-0000-000000000028','release_gate','14000000-0000-0000-0000-000000000027','baseline','bad-baseline',repeat('7',64),'repo://synthetic/g8/baseline'),
  ('14000000-0000-0000-0000-000000000029','release_gate','14000000-0000-0000-0000-000000000027','threshold','bad-threshold',repeat('8',64),'repo://synthetic/g8/threshold'),
  ('14000000-0000-0000-0000-00000000002a','release_gate','14000000-0000-0000-0000-000000000027','rollback','bad-rollback',repeat('9',64),'repo://synthetic/g8/rollback');
DO $$
BEGIN
  BEGIN
    INSERT INTO app.ci_release_gate (
      gate_id, submission_id, release_id, red_green_passed, contract_passed,
      e2e_passed, runtime_proof_passed, public_proof_passed, ssot_synced,
      evidence_refs, baseline_artifact_id, threshold_artifact_id,
      provenance_artifact_ids, rollback_artifact_id, qualified
    ) VALUES (
      '14000000-0000-0000-0000-000000000027','14000000-0000-0000-0000-000000000026',
      'oas-g8-release-missing-provenance',TRUE,TRUE,TRUE,TRUE,TRUE,TRUE,
      '{audit://synthetic/g8/release}','14000000-0000-0000-0000-000000000028',
      '14000000-0000-0000-0000-000000000029','{14000000-0000-0000-0000-00000000002b}',
      '14000000-0000-0000-0000-00000000002a',TRUE
    );
    RAISE EXCEPTION 'incomplete release gate unexpectedly succeeded';
  EXCEPTION WHEN check_violation THEN NULL;
  END;
END;
$$;

-- Unsafe model candidate computes rollback, but execution still needs a human event.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000030',repeat('a',64),'model_change_gate',
  '14000000-0000-0000-0000-000000000031'
);
INSERT INTO app.ci_gate_artifact (
  artifact_record_id, owner_kind, owner_id, artifact_kind, artifact_id,
  content_sha256, provenance_uri
) VALUES
  ('14000000-0000-0000-0000-000000000032','model_change_gate','14000000-0000-0000-0000-000000000031','baseline','model-baseline',repeat('b',64),'db://synthetic/g8/model-baseline'),
  ('14000000-0000-0000-0000-000000000033','model_change_gate','14000000-0000-0000-0000-000000000031','threshold','model-threshold',repeat('c',64),'repo://synthetic/g8/model-threshold'),
  ('14000000-0000-0000-0000-000000000034','model_change_gate','14000000-0000-0000-0000-000000000031','provenance','model-provenance',repeat('d',64),'audit://synthetic/g8/model-provenance'),
  ('14000000-0000-0000-0000-000000000035','model_change_gate','14000000-0000-0000-0000-000000000031','rollback','model-rollback',repeat('e',64),'repo://synthetic/g8/model-rollback');
INSERT INTO app.ci_model_calibration_snapshot (
  snapshot_record_id, gate_id, snapshot_role, snapshot_id, model_name,
  prompt_version, benchmark_version, task_accuracy, critical_miss_count,
  leakage_count, pii_count, calibration_error, subgroup_max_gap
) VALUES
  ('14000000-0000-0000-0000-000000000036','14000000-0000-0000-0000-000000000031','baseline',
   'oas-g8-model-snapshot-smoke-baseline','model-a','p1','b1',0.90,0,0,0,0.10,0.10),
  ('14000000-0000-0000-0000-000000000037','14000000-0000-0000-0000-000000000031','candidate',
   'oas-g8-model-snapshot-smoke-candidate','model-b','p2','b1',0.91,1,0,0,0.10,0.10);
DO $$
BEGIN
  BEGIN
    INSERT INTO app.ci_model_change_gate (
      gate_id, submission_id, baseline_snapshot_record_id, candidate_snapshot_record_id,
      baseline_artifact_id, threshold_artifact_id, provenance_artifact_ids,
      rollback_artifact_id, gate_decision, reasons, rollback_target_snapshot_id
    ) VALUES (
      '14000000-0000-0000-0000-000000000031','14000000-0000-0000-0000-000000000030',
      '14000000-0000-0000-0000-000000000036','14000000-0000-0000-0000-000000000037',
      '14000000-0000-0000-0000-000000000032','14000000-0000-0000-0000-000000000033',
      '{14000000-0000-0000-0000-000000000034}','14000000-0000-0000-0000-000000000035',
      'promote','{fabricated-pass}',NULL
    );
    RAISE EXCEPTION 'unsafe model candidate bypassed calibration gate';
  EXCEPTION WHEN check_violation THEN NULL;
  END;
END;
$$;
INSERT INTO app.ci_model_change_gate (
  gate_id, submission_id, baseline_snapshot_record_id, candidate_snapshot_record_id,
  baseline_artifact_id, threshold_artifact_id, provenance_artifact_ids,
  rollback_artifact_id, gate_decision, reasons, rollback_target_snapshot_id
) VALUES (
  '14000000-0000-0000-0000-000000000031','14000000-0000-0000-0000-000000000030',
  '14000000-0000-0000-0000-000000000036','14000000-0000-0000-0000-000000000037',
  '14000000-0000-0000-0000-000000000032','14000000-0000-0000-0000-000000000033',
  '{14000000-0000-0000-0000-000000000034}','14000000-0000-0000-0000-000000000035',
  'rollback','{critical_miss_regression}','oas-g8-model-snapshot-smoke-baseline'
);

-- Operational incident becomes the ordered four-node regression DAG.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000040',repeat('f',64),'incident_dag',
  '14000000-0000-0000-0000-000000000041'
);
INSERT INTO app.ci_operational_incident (
  incident_record_id, submission_id, incident_id, error_fingerprint,
  affected_contract, evidence_refs, pii_included
) VALUES (
  '14000000-0000-0000-0000-000000000041','14000000-0000-0000-0000-000000000040',
  'oas-g8-incident-smoke',repeat('1',64),'synthetic.replay',
  '{audit://synthetic/g8/incident}',FALSE
);
INSERT INTO app.ci_regression_dag_node (
  node_record_id, incident_record_id, node_id, node_type,
  depends_on_record_ids, evidence_ref, node_status
) VALUES
  ('14000000-0000-0000-0000-000000000042','14000000-0000-0000-0000-000000000041','oas-g8-node-smoke-reproduction','reproduction_test','{}','audit://synthetic/g8/incident','pending'),
  ('14000000-0000-0000-0000-000000000043','14000000-0000-0000-0000-000000000041','oas-g8-node-smoke-implementation','implementation','{14000000-0000-0000-0000-000000000042}',NULL,'pending'),
  ('14000000-0000-0000-0000-000000000044','14000000-0000-0000-0000-000000000041','oas-g8-node-smoke-e2e','e2e','{14000000-0000-0000-0000-000000000043}',NULL,'pending'),
  ('14000000-0000-0000-0000-000000000045','14000000-0000-0000-0000-000000000041','oas-g8-node-smoke-runtime','runtime_proof','{14000000-0000-0000-0000-000000000044}',NULL,'pending');

DO $$
BEGIN
  IF (SELECT count(*) FROM app.ci_content_qualification
      WHERE qualification_id = '14000000-0000-0000-0000-000000000019') <> 1
     OR (SELECT count(*) FROM app.ci_release_gate
         WHERE gate_id = '14000000-0000-0000-0000-000000000021') <> 1
     OR (SELECT count(*) FROM app.ci_model_change_gate
         WHERE gate_id = '14000000-0000-0000-0000-000000000031') <> 1
     OR (SELECT count(*) FROM app.ci_regression_dag_node
         WHERE incident_record_id = '14000000-0000-0000-0000-000000000041') <> 4 THEN
    RAISE EXCEPTION 'research automation cannot read its G8 ledgers';
  END IF;
  IF (SELECT count(*) FROM app.ci_catalog_entry
      WHERE qualification_id = '14000000-0000-0000-0000-000000000019') <> 0
     OR (SELECT count(*) FROM audit.ci_human_approval_event
         WHERE target_id IN (
           '14000000-0000-0000-0000-000000000019',
           '14000000-0000-0000-0000-000000000021',
           '14000000-0000-0000-0000-000000000031'
         )) <> 0
     OR (SELECT count(*) FROM audit.ci_lifecycle_event
         WHERE target_id IN (
           '14000000-0000-0000-0000-000000000021',
           '14000000-0000-0000-0000-000000000031'
         )) <> 0 THEN
    RAISE EXCEPTION 'silent automatic promotion or lifecycle event detected';
  END IF;
  BEGIN
    INSERT INTO audit.ci_lifecycle_event (
      lifecycle_event_id, submission_id, target_kind, target_id, event_type,
      event_status, evidence_refs, content_hash
    ) VALUES (
      '14000000-0000-0000-0000-000000000046','14000000-0000-0000-0000-000000000020',
      'release_gate','14000000-0000-0000-0000-000000000021','promotion','approved',
      '{audit://synthetic/g8/release}',repeat('2',64)
    );
    RAISE EXCEPTION 'research agent silently promoted release';
  EXCEPTION WHEN check_violation OR insufficient_privilege THEN NULL;
  END;
END;
$$;

-- Even the owner cannot fabricate a catalog entry without a matching approval event.
RESET ROLE;
DO $$
BEGIN
  BEGIN
    INSERT INTO app.ci_catalog_entry (
      catalog_record_id, qualification_id, approval_event_id, catalog_entry_id,
      payload_sha256, source_record_ids, review_record_ids, benchmark_record_id
    ) VALUES (
      '14000000-0000-0000-0000-000000000047','14000000-0000-0000-0000-000000000019',
      '14000000-0000-0000-0000-000000000048','oas-g8-catalog-smoke',repeat('e',64),
      '{14000000-0000-0000-0000-000000000011}',
      '{14000000-0000-0000-0000-000000000013,14000000-0000-0000-0000-000000000014}',
      '14000000-0000-0000-0000-000000000018'
    );
    RAISE EXCEPTION 'catalog entry bypassed human approval';
  EXCEPTION WHEN check_violation THEN NULL;
  END;
END;
$$;

-- Admin approval creates the only allowed promotion/rollback effects.
SET LOCAL ROLE vignette;
SELECT set_config('app.ai_context','',true);
SELECT set_config('app.current_ai_view','',true);
SELECT set_config('app.current_role','admin',true);
SELECT set_config('app.current_uid','14000000-0000-0000-0000-000000000001',true);

-- 보류와 반려는 모든 대상에서 감사 기록만 남기고 효과를 만들지 않는다.
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES
  ('14000000-0000-0000-0000-000000000064',repeat('8',64),'human_approval','14000000-0000-0000-0000-000000000065'),
  ('14000000-0000-0000-0000-000000000066',repeat('9',64),'human_approval','14000000-0000-0000-0000-000000000067');
INSERT INTO audit.ci_human_approval_event (
  approval_event_id, submission_id, target_kind, target_id, decision, actor_uid,
  reason_code, evidence_refs, content_hash
) VALUES
  (
    '14000000-0000-0000-0000-000000000065','14000000-0000-0000-0000-000000000064',
    'content_qualification','14000000-0000-0000-0000-000000000019','keep_quarantine',
    '14000000-0000-0000-0000-000000000001','more-evidence-required',
    '{audit://synthetic/g8/content-hold}',repeat('8',64)
  ),
  (
    '14000000-0000-0000-0000-000000000067','14000000-0000-0000-0000-000000000066',
    'release_gate','14000000-0000-0000-0000-000000000021','reject',
    '14000000-0000-0000-0000-000000000001','release-rejected',
    '{audit://synthetic/g8/release-reject}',repeat('9',64)
  );
DO $$
BEGIN
  IF (SELECT count(*) FROM audit.ci_human_approval_event
      WHERE approval_event_id IN (
        '14000000-0000-0000-0000-000000000065',
        '14000000-0000-0000-0000-000000000067'
      )) <> 2
     OR EXISTS (
       SELECT 1 FROM app.ci_catalog_entry
       WHERE approval_event_id = '14000000-0000-0000-0000-000000000065'
     )
     OR EXISTS (
       SELECT 1 FROM audit.ci_lifecycle_event
       WHERE approval_event_id IN (
         '14000000-0000-0000-0000-000000000065',
         '14000000-0000-0000-0000-000000000067'
       )
     ) THEN
    RAISE EXCEPTION 'fail-closed human decision created a side effect';
  END IF;
END;
$$;

INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000050',repeat('3',64),'human_approval',
  '14000000-0000-0000-0000-000000000051'
);
INSERT INTO audit.ci_human_approval_event (
  approval_event_id, submission_id, target_kind, target_id, decision, actor_uid,
  reason_code, evidence_refs, content_hash
) VALUES (
  '14000000-0000-0000-0000-000000000051','14000000-0000-0000-0000-000000000050',
  'content_qualification','14000000-0000-0000-0000-000000000019','approve_content',
  '14000000-0000-0000-0000-000000000001','human-reviewed',
  '{audit://synthetic/g8/content-approval}',repeat('3',64)
);
INSERT INTO app.ci_catalog_entry (
  catalog_record_id, qualification_id, approval_event_id, catalog_entry_id,
  payload_sha256, source_record_ids, review_record_ids, benchmark_record_id
) VALUES (
  '14000000-0000-0000-0000-000000000052','14000000-0000-0000-0000-000000000019',
  '14000000-0000-0000-0000-000000000051','oas-g8-catalog-smoke',repeat('e',64),
  '{14000000-0000-0000-0000-000000000011}',
  '{14000000-0000-0000-0000-000000000013,14000000-0000-0000-0000-000000000014}',
  '14000000-0000-0000-0000-000000000018'
);

INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000053',repeat('4',64),'human_approval',
  '14000000-0000-0000-0000-000000000054'
);
INSERT INTO audit.ci_human_approval_event (
  approval_event_id, submission_id, target_kind, target_id, decision, actor_uid,
  reason_code, evidence_refs, content_hash
) VALUES (
  '14000000-0000-0000-0000-000000000054','14000000-0000-0000-0000-000000000053',
  'release_gate','14000000-0000-0000-0000-000000000021','approve_promotion',
  '14000000-0000-0000-0000-000000000001','release-reviewed',
  '{audit://synthetic/g8/release-approval}',repeat('4',64)
);
INSERT INTO audit.ci_lifecycle_event (
  lifecycle_event_id, submission_id, target_kind, target_id, event_type,
  event_status, approval_event_id, evidence_refs, content_hash
) VALUES (
  '14000000-0000-0000-0000-000000000055','14000000-0000-0000-0000-000000000053',
  'release_gate','14000000-0000-0000-0000-000000000021','promotion','approved',
  '14000000-0000-0000-0000-000000000054','{audit://synthetic/g8/release-approval}',repeat('4',64)
);

INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES (
  '14000000-0000-0000-0000-000000000056',repeat('5',64),'human_approval',
  '14000000-0000-0000-0000-000000000057'
);
INSERT INTO audit.ci_human_approval_event (
  approval_event_id, submission_id, target_kind, target_id, decision, actor_uid,
  reason_code, evidence_refs, content_hash
) VALUES (
  '14000000-0000-0000-0000-000000000057','14000000-0000-0000-0000-000000000056',
  'model_change_gate','14000000-0000-0000-0000-000000000031','authorize_rollback',
  '14000000-0000-0000-0000-000000000001','critical-miss',
  '{audit://synthetic/g8/model-rollback}',repeat('5',64)
);
DO $$
BEGIN
  BEGIN
    INSERT INTO audit.ci_lifecycle_event (
      lifecycle_event_id, submission_id, target_kind, target_id, event_type,
      event_status, approval_event_id, artifact_record_id, evidence_refs, content_hash
    ) VALUES (
      '14000000-0000-0000-0000-000000000059','14000000-0000-0000-0000-000000000056',
      'model_change_gate','14000000-0000-0000-0000-000000000031','rollback','executed',
      '14000000-0000-0000-0000-000000000057','14000000-0000-0000-0000-000000000035',
      '{audit://synthetic/g8/model-rollback}',repeat('5',64)
    );
    RAISE EXCEPTION 'rollback without executor receipt unexpectedly succeeded';
  EXCEPTION WHEN check_violation THEN NULL;
  END;
END;
$$;
INSERT INTO audit.ci_lifecycle_event (
  lifecycle_event_id, submission_id, target_kind, target_id, event_type,
  event_status, approval_event_id, artifact_record_id, evidence_refs, content_hash,
  executor_receipt_id, executor_evidence_refs
) VALUES (
  '14000000-0000-0000-0000-000000000058','14000000-0000-0000-0000-000000000056',
  'model_change_gate','14000000-0000-0000-0000-000000000031','rollback','executed',
  '14000000-0000-0000-0000-000000000057','14000000-0000-0000-0000-000000000035',
  '{audit://synthetic/g8/model-rollback,audit://synthetic/g8/model-rollback-execution}',
  repeat('5',64),'synthetic-ledger-execution-001',
  '{audit://synthetic/g8/model-rollback-execution}'
);

DO $$
BEGIN
  IF (SELECT count(*) FROM audit.ci_human_approval_event
      WHERE approval_event_id IN (
        '14000000-0000-0000-0000-000000000051',
        '14000000-0000-0000-0000-000000000054',
        '14000000-0000-0000-0000-000000000057'
      )) <> 3
     OR (SELECT count(*) FROM app.ci_catalog_entry
         WHERE qualification_id = '14000000-0000-0000-0000-000000000019') <> 1
     OR (SELECT count(*) FROM audit.ci_lifecycle_event
         WHERE event_type = 'promotion'
           AND target_id = '14000000-0000-0000-0000-000000000021') <> 1
     OR (SELECT count(*) FROM audit.ci_lifecycle_event
         WHERE event_type = 'rollback'
           AND target_id = '14000000-0000-0000-0000-000000000031') <> 1 THEN
    RAISE EXCEPTION 'admin approval effects were not durably appended';
  END IF;
END;
$$;

-- Learner and instructor have no CI control-plane visibility.
SELECT set_config('app.current_role','learner',true);
SELECT set_config('app.current_uid','14000000-0000-0000-0000-000000000002',true);
DO $$ BEGIN
  IF (SELECT count(*) FROM app.ci_release_gate) <> 0
     OR (SELECT count(*) FROM audit.ci_human_approval_event) <> 0 THEN
    RAISE EXCEPTION 'learner CI control-plane leak';
  END IF;
END $$;
SELECT set_config('app.current_role','instructor',true);
SELECT set_config('app.current_uid','14000000-0000-0000-0000-000000000003',true);
DO $$ BEGIN
  IF (SELECT count(*) FROM app.ci_content_qualification) <> 0
     OR (SELECT count(*) FROM audit.ci_lifecycle_event) <> 0 THEN
    RAISE EXCEPTION 'instructor CI control-plane leak';
  END IF;
END $$;

-- Missing GUC/public context is fail closed.
SELECT set_config('app.current_role','',true);
SELECT set_config('app.current_uid','',true);
DO $$ BEGIN
  IF (SELECT count(*) FROM app.ci_release_gate) <> 0
     OR (SELECT count(*) FROM app.ci_catalog_entry) <> 0
     OR (SELECT count(*) FROM audit.ci_lifecycle_event) <> 0 THEN
    RAISE EXCEPTION 'public CI visibility leak';
  END IF;
END $$;

-- Research appends synthetic coverage-drift monitoring; rollback verification sees prior rollback.
SELECT set_config('app.ai_context','1',true);
SELECT set_config('app.current_ai_view','research',true);
INSERT INTO app.ci_ingestion_submission (
  submission_id, content_hash, operation_kind, result_id
) VALUES
  ('14000000-0000-0000-0000-000000000060',repeat('6',64),'monitor_event','14000000-0000-0000-0000-000000000061'),
  ('14000000-0000-0000-0000-000000000062',repeat('7',64),'monitor_event','14000000-0000-0000-0000-000000000063');
INSERT INTO audit.ci_lifecycle_event (
  lifecycle_event_id, submission_id, target_kind, target_id, event_type,
  event_status, evidence_refs, content_hash
) VALUES
  ('14000000-0000-0000-0000-000000000061','14000000-0000-0000-0000-000000000060',
   'release_gate','14000000-0000-0000-0000-000000000021','monitor','healthy',
   '{audit://synthetic/g8/coverage-drift}',repeat('6',64)),
  ('14000000-0000-0000-0000-000000000063','14000000-0000-0000-0000-000000000062',
   'model_change_gate','14000000-0000-0000-0000-000000000031','monitor','rollback_verified',
   '{audit://synthetic/g8/rollback-verification}',repeat('7',64));

RESET ROLE;
DO $$
BEGIN
  BEGIN
    UPDATE app.ci_release_gate SET qualified = FALSE
    WHERE gate_id = '14000000-0000-0000-0000-000000000021';
    RAISE EXCEPTION 'append-only release update unexpectedly succeeded';
  EXCEPTION WHEN object_not_in_prerequisite_state THEN NULL;
  END;
  BEGIN
    DELETE FROM audit.ci_lifecycle_event
    WHERE lifecycle_event_id = '14000000-0000-0000-0000-000000000058';
    RAISE EXCEPTION 'append-only lifecycle delete unexpectedly succeeded';
  EXCEPTION WHEN object_not_in_prerequisite_state THEN NULL;
  END;
END;
$$;

ROLLBACK;

DO $$
BEGIN
  IF EXISTS (SELECT 1 FROM app.app_user
       WHERE user_id >= '14000000-0000-0000-0000-000000000000'
         AND user_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_ingestion_submission
       WHERE submission_id >= '14000000-0000-0000-0000-000000000000'
         AND submission_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_source_artifact
       WHERE source_record_id >= '14000000-0000-0000-0000-000000000000'
         AND source_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_content_pipeline
       WHERE pipeline_id >= '14000000-0000-0000-0000-000000000000'
         AND pipeline_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_red_team_review
       WHERE review_record_id >= '14000000-0000-0000-0000-000000000000'
         AND review_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_content_benchmark
       WHERE benchmark_record_id >= '14000000-0000-0000-0000-000000000000'
         AND benchmark_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_content_qualification
       WHERE qualification_id >= '14000000-0000-0000-0000-000000000000'
         AND qualification_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_gate_artifact
       WHERE artifact_record_id >= '14000000-0000-0000-0000-000000000000'
         AND artifact_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_release_gate
       WHERE gate_id >= '14000000-0000-0000-0000-000000000000'
         AND gate_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_model_calibration_snapshot
       WHERE snapshot_record_id >= '14000000-0000-0000-0000-000000000000'
         AND snapshot_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_model_change_gate
       WHERE gate_id >= '14000000-0000-0000-0000-000000000000'
         AND gate_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_operational_incident
       WHERE incident_record_id >= '14000000-0000-0000-0000-000000000000'
         AND incident_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_regression_dag_node
       WHERE node_record_id >= '14000000-0000-0000-0000-000000000000'
         AND node_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM audit.ci_human_approval_event
       WHERE approval_event_id >= '14000000-0000-0000-0000-000000000000'
         AND approval_event_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM app.ci_catalog_entry
       WHERE catalog_record_id >= '14000000-0000-0000-0000-000000000000'
         AND catalog_record_id < '14000000-0000-0000-0000-000000000100')
     OR EXISTS (SELECT 1 FROM audit.ci_lifecycle_event
       WHERE lifecycle_event_id >= '14000000-0000-0000-0000-000000000000'
         AND lifecycle_event_id < '14000000-0000-0000-0000-000000000100') THEN
    RAISE EXCEPTION 'G8 smoke rollback left residue';
  END IF;
END;
$$;

SELECT 'G8 continuous improvement smoke: PASS (rollback residue 0)' AS result;