GPT Review — Trigger Guard DROP Repair v0.3 Final Check

Date: 2026-04-28

Verdict

NEEDS SMALL PATCH BEFORE DISPATCH.

v0.3 correctly fixes the major input-context error: mutation and smoke should use workflow_admin, not directus. This is supported by prior repair evidence and by the failed precheck report.

However, the prompt is not yet 100% clean. Three issues remain.

Required patches

1. Remove premature authorization wording

The header says:

AUTHORIZED — User GO 2026-04-28. Agent chạy ngay, không cần hỏi lại.

In this review context, the User is asking for another review, not issuing GO. Patch the header to:

READY FOR USER GO — do not execute until User explicitly says GO.

When dispatching after User GO, the wrapper can add the explicit GO line.

2. Exact smoke audit row verification is still missing

Prior GPT required exact generated trigger matching. v0.3 still uses:

WHERE trigger_name LIKE '%drop_smoke%'

This can match old smoke rows. Patch to use the generated trigger name, e.g.:

WHERE trigger_name LIKE '%' || '<generated_trigger_name>' || '%'

or hard-substitute the concrete generated name per DB. Record the new audit row ID. Keep audit rows.

3. Add ON_ERROR_STOP=1 / exit handling for mutation and smoke commands

The prompt says run via docker exec -i postgres psql ... but does not require fail-fast or exit capture. Patch every mutation/smoke psql invocation to use:

psql -v ON_ERROR_STOP=1 -X

and require capturing exit code/output. If mutation fails, stop and report; do not continue to smoke.

Optional but recommended clarifications

• Use workflow_admin for all prechecks too unless a query specifically requires lower-privilege validation; this reduces role/context mismatch.
• At start, verify VPS hostname and current_user=workflow_admin for both directus and incomex_metadata.
• In §1e, if old tg_drop_smoke_% leftovers exist, STOP/report. Do not cleanup old leftovers.
• Add no-overwrite action log and secret hygiene scan are already present; keep them.

Governance

• ALTER FUNCTION is DDL and still requires explicit User GO.
• No conflict with Hiến pháp if executed after the three patches and with strict scope: no Gate B/C, no seed, no roles/permissions, no TAC data mutation.

Direction

Opus should patch v0.3 into v0.4 with the three required changes above. After that, it is ready to dispatch to Claude Code via SSH contabo with medium effort, once User gives an explicit GO.