claude/zealous-lovelace-cbc97f
needs attentionviewing older commitb7dc960 · incrementalPR #215reviewed 2026-07-04 02:25 UTC0H · 1M · 4L · 5I- Purpose
- feat/api-dx — Complete the public API developer experience with per-RPU payment status endpoint and customer webhooks (bill.created, bill.paid) with HMAC-signed payloads.
- Goal
- Add nightly reconcile-and-repair for utility_contract_overview drift (ADR-020 follow-up): SECURITY DEFINER plpgsql function diffs the read-model vs derive(), repairs divergent pairs, logs to audit table, pg_cron-scheduled nightly.
- Sub-goals
- SG-1: webhook_endpoints schema + migration + RLS (done)
- SG-2: webhook-endpoint FCIS + HMAC signing + unit tests (done)
- SG-3: public API — webhooks CRUD + payment-status + schemas (done)
- SG-4: dispatcher service (done)
- SG-5: CDK WebhooksStack + app wiring (done)
- SG-6: quality gate + docs + reconcile nightly job (this PR)
- What
- Re-slot migration from 0053→0054 due to merge collision. Renamed SQL file, added 0054_snapshot.json, updated all docs/ADR/CLAUDE.md references.
- Why
- Slot 0053 was claimed by webhook-endpoints migration on main. Re-slotting to 0054 required for ordered migration application.
- Areas
- .github/workflows+1−1docs/ADRs+4−4domains/utility+1−1packages/database+12020−5
- Blast
- 8 files, +12026/−5 in incremental window. Core SQL logic unchanged.
Findings · 10
correctness1
last_checked_at not excluded from drift JSONB diff
packages/database/drizzle/0054_tense_gauntlet.sql:105
If derive expression for last_checked_at ever diverges from backfill logic, every row would be a false-positive mismatch. No bug today.
security1
Confirm watchdog DB credential is service_role
.github/workflows/uco-drift-watchdog.yml
Audit table has RLS with service_role-only policy. Non-service_role sees no rows → false NOT_DEPLOYED verdict.
conventions1
webhook-endpoints export out-of-scope for re-slot commit
packages/database/src/schema/index.ts:136
export * from './webhook-endpoints' is a webhook feature (SG-1) change that landed in this migration re-slot commit. Export is correct and needed — note it in the PR description.
tests2
Repair-cap boundary (2000 pairs) is not tested
packages/database/drizzle/0054_tense_gauntlet.sql
Unit tests inject 1-2 pairs only. A single stub test with repaired < drift_count would verify the partial-repair signal.
pg_cron guard block has no migration smoke test
packages/database/drizzle/0054_tense_gauntlet.sql
DO $$ block silently degrades to NOTICE on pg_cron-less CI. Future SQL syntax errors would be swallowed.
improvement5
pg_notify uses json_build_object inconsistently
packages/database/drizzle/0054_tense_gauntlet.sql:162
Replace with jsonb_build_object(...)::text for consistency with rest of function.
COALESCE around count() FILTER is dead code
packages/database/drizzle/0054_tense_gauntlet.sql:109
count() never returns NULL. The four COALESCE wrappers can be removed.
Sample cap 100 should be a named constant
packages/database/drizzle/0054_tense_gauntlet.sql:134
c_sample_cap constant integer := 100 to match style of c_repair_cap.
RAISE WARNING CASE expression — extract to variable
packages/database/drizzle/0054_tense_gauntlet.sql:156
Pre-compute v_cap_note text to separate conditional from message assembly.
Redundant DROP before ON COMMIT DROP
packages/database/drizzle/0054_tense_gauntlet.sql:84
Only needed for same-transaction re-entrancy (unlikely). Remove or document the specific scenario.
History · 8 commits
- df474d4needs attentionincremental2H · 3M · 6L2026-07-22 23:12
- 8b749afneeds attentionincremental0H · 1M · 3L2026-07-14 17:58
- 8f01e3bsafeincremental0H · 0M · 0L2026-07-07 16:58
- 6fb3b0aneeds attentionincremental0H · 1M · 3L2026-07-06 16:26
- b7dc960needs attentionincremental0H · 1M · 4L2026-07-04 02:25current
- c0927dfneeds attentionincremental0H · 2M · 3L2026-07-03 06:34
- 1328ef5needs attentionincremental1H · 4M · 5L2026-07-03 06:26
- 4c3d40dneeds attentionfull6H · 15M · 12L2026-07-03 06:05