- one least-privilege role per daemon; cayce_approver is the ONLY writer of
status=APPROVED / operator_signature / approved columns
- per-table BEFORE triggers reject approval writes from daemon roles
- no literal passwords: refuses to run without the six -v password vars
(psql exits 3 via missing-table SELECT guard)
- idempotent: revokes + drops trigger/function before recreating
- tests/integration/test_pg_roles.py: applies roles.sql via psql -v, runs a
full cycle per daemon role (propose -> approve -> execute; compose ->
approve -> send; plan -> approve -> publish; anchor) and asserts the
denials; runs the alembic upgrade->downgrade->upgrade round-trip on
Postgres (point 6). Skips cleanly without a reachable PG.
cayce
d77409148c