Skip to content

test(stack): close v3 query-permutation coverage gaps (neq, contained_by, range)#587

Merged
tobyhede merged 1 commit into
feat/eql-v3-text-search-schemafrom
test/eql-v3-query-permutation-coverage
Jul 9, 2026
Merged

test(stack): close v3 query-permutation coverage gaps (neq, contained_by, range)#587
tobyhede merged 1 commit into
feat/eql-v3-text-search-schemafrom
test/eql-v3-query-permutation-coverage

Conversation

@tobyhede

@tobyhede tobyhede commented Jul 9, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Follow-up stacked on the EQL v3 / protect-ffi 0.28 work (PR #575 chore/eql-v3-ffi-0-28, now merged into feat/eql-v3-text-search-schema). Closes the four query-permutation coverage gaps found by adversarial verification. Additive tests only — no src/ changes.

Gaps closed (all in matrix-live-pg.test.ts, 57 → 86 tests)

  • eql_v3.neq / <> — it.each(eqDomains): neq(samples[0]) selects the other row, excludes the matching one.
  • eql_v3.contained_by / <@ — it.each(matchDomains): dual of contains; operand covers row idA's token set → idA contained_by, idB excluded.
  • explicit two-bound range + strict gt/lt — it.each(orderingDomains): over the distinct-sample rows, gte+lte (inclusive) selects all, gt+lt (exclusive) selects only the interior. Previously the 14 numeric/date/ts ORE domains' "range" test actually ran eql_v3.eq.
  • rename the misleading "ORE range selects the exact row" → "equality-via-ORE selects the exact row".

Notes

  • Operands reuse the already-encrypted ORDER_RUN_ID ciphertexts — no extra encryption.
  • All new proofs use boolean comparison operators, ORE-correct on superuser (CI) and non-superuser (local/Supabase) Postgres — verified green on a non-superuser local role. No ORDER BY ord_term.
  • Verification: matrix-live-pg 86/86, test:types 60/60.

Summary by CodeRabbit

  • Tests
    • Expanded live Postgres coverage with additional proof cases for inequality, containment, and range-bound checks.
    • Improved validation of encrypted ordering behavior to confirm both inclusive and exclusive bounds return the expected records.
    • Clarified existing proof descriptions for better readability.

@tobyhede
test(stack): close v3 query-permutation coverage gaps (neq, contained…
7f001ab 
…_by, range)

Follow-up to the protect-ffi 0.28 PR. Adversarial coverage verification found four
public two-arg eql_v3.* functions the SDK can drive but no test exercised. Add
data-driven proofs across every applicable domain in matrix-live-pg (57 -> 86):

- eql_v3.neq / <> — new it.each(eqDomains): operand = samples[0]; neq selects the
  other row (idB) and excludes the matching row (idA).
- eql_v3.contained_by / <@ — new it.each(matchDomains): the dual of contains;
  operand covers row idA's token set so idA is contained_by it and idB is not.
- explicit two-bound range + strict gt/lt — new it.each(orderingDomains): over the
  distinct-sample ORDER_RUN_ID rows, gte+lte (inclusive [lo,hi]) selects all,
  gt+lt (exclusive) selects only the interior. Closes the gap where the 14
  numeric/date/ts ORE domains' "range" test actually ran eql_v3.eq.
- rename the misleading ord test "ORE range selects the exact row" ->
  "equality-via-ORE selects the exact row" (accurate: it runs eq / degenerate
  range).

Operands reuse the already-encrypted ORDER_RUN_ID ciphertexts (encModels) — no
extra encryption. All new proofs use boolean comparison operators (ORE-correct on
superuser AND non-superuser Postgres — verified green on a non-superuser local
role), never ORDER BY ord_term. No src changes. matrix-live-pg 86/86, types 60/60.
@tobyhede tobyhede requested a review from a team as a code owner July 9, 2026 00:45
@changeset-bot

changeset-bot Bot commented Jul 9, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 7f001ab

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 71c665cb-938e-48d9-b6e8-86bc96c269e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • ✅ Review completed - (🔄 Check again to review again)
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch test/eql-v3-query-permutation-coverage

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@tobyhede tobyhede merged commit 419cc68 into feat/eql-v3-text-search-schema Jul 9, 2026
6 checks passed
@tobyhede tobyhede deleted the test/eql-v3-query-permutation-coverage branch July 9, 2026 03:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tobyhede