HC-TRIGGER enforcement gap query
-- HC-TRIGGER: Count of governed tables with description col but missing trg_desc_guard_* -- DB: directus | Schema: public | Read-only | Returns single-row count for dispatch_sql -- NOTE: Uses pg_catalog (pg_trigger + pg_class + pg_namespace) instead of -- information_schema.triggers, because information_schema.triggers filters by -- TRIGGER privilege on the underlying relation. Read-only roles without that -- privilege see zero rows and would wrongly report a huge gap. pg_catalog -- views are visible to every role, so admin and RO roles agree. SELECT count(*)::int AS trigger_gap_count FROM ( SELECT cr.collection_name FROM collection_registry cr JOIN information_schema.columns c ON c.table_name = cr.collection_name AND c.column_name = 'description' AND c.table_schema = 'public' WHERE cr.governance_role = 'governed' AND c.table_name IN ( SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' AND table_type = 'BASE TABLE' ) AND cr.collection_name NOT IN ( SELECT DISTINCT cls.relname FROM pg_trigger t JOIN pg_class cls ON t.tgrelid = cls.oid JOIN pg_namespace nsp ON cls.relnamespace = nsp.oid WHERE nsp.nspname = 'public' AND t.tgname LIKE 'trg_desc_guard_%' AND NOT t.tgisinternal ) ) t