From 024993f18a104be35be4e993338c59b8b2b2ea58 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Thu, 13 Aug 2026 12:40:05 +0200
Subject: [PATCH] Close T05: live matrix 12 pass / 0 fail / 3 skip

In-pod remote run. S08 needed UPDATE on secret_findings; granted and
recorded as migration 0005. Disruption scenarios remain operator-owned.
---
 audit_core/postgres_backend.py                   | 15 +++++++++++++++
 ...5-postgres-store-and-production-deployment.md | 16 ++++++++--------
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/audit_core/postgres_backend.py b/audit_core/postgres_backend.py
index ec775e7..742df71 100644
--- a/audit_core/postgres_backend.py
+++ b/audit_core/postgres_backend.py
@@ -119,6 +119,21 @@ MIGRATIONS: list[tuple[str, str]] = [
         );
         """,
     ),
+    (
+        "0005-runtime-grants",
+        """
+        DO $grant$
+        BEGIN
+          IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'audit_core_app') THEN
+            EXECUTE 'GRANT SELECT, INSERT ON {schema}.events TO audit_core_app';
+            EXECUTE 'GRANT SELECT, INSERT ON {schema}.dead_letters TO audit_core_app';
+            EXECUTE 'GRANT SELECT, INSERT, UPDATE ON {schema}.secret_findings TO audit_core_app';
+            EXECUTE 'GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA {schema} TO audit_core_app';
+          END IF;
+        END
+        $grant$;
+        """,
+    ),
 ]
 
 # Rejection reasons whose payload must never be persisted — storing the body of
diff --git a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
index 0a358fa..3c8d8b6 100644
--- a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
+++ b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
@@ -401,7 +401,7 @@ empty-source case that is today's actual situation.
 
 ```task
 id: AUDIT-WP-0005-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "1da30fec-b9f1-4be0-b42c-15797a8c4392"
 ```
@@ -457,13 +457,13 @@ against an unreachable receiver (it does not pass silently), and the emitted
 evidence JSON contains no tokens, credentials, or event payloads, so a run
 against the deployed receiver can go to NK-WP-0024 as-is.
 
-Remote run 2026-08-13 (`evidence/failure-matrix-20260813T103540Z.json`,
-`MODE=remote DISRUPT=0`): **7 passed, 5 failed, 3 skipped**. S01–S07 passed
-on the live receiver (accept, duplicate, conflict, cross-tenant 400, dead
-letter, 401, redaction). S08–S12 failed with `status=0` (port-forward
-dropped mid-run), not a contract mismatch. S13–S15 skipped (`DISRUPT=0`,
-replay needs DB). Re-run through a stable operator path before handing
-NK-WP-0024; do not treat this JSON as closeout.
+Closeout 2026-08-13: re-ran inside the receiver pod
+(`evidence/failure-matrix-20260813T103908Z.json`). **12 passed, 0 failed,
+3 skipped.** S01–S12 green on the live OpenBao-leased store. S13 skipped
+(remote has no direct DB). S14–S15 skipped (`DISRUPT=0` — not this
+script's call to restart production Postgres). S08 first failed because
+`secret_findings` upsert needs UPDATE; granted to `audit_core_app` and
+locked in migration 0005. That JSON is the NK-WP-0024 hand-back.
 
 ## T06 - Operational handover