feat(vnext): authenticate CTE main query sites#190
Merged
Conversation
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Pull request overview
This PR strengthens vnext SQL “query-site” recognition by authenticating the provenance of CTE main-query entrypoints (and related inputs) before they can influence relation query-site detection, while keeping the low-level recognizer independent of CTE/layout modules.
Changes:
- Adds snapshot/authentication mechanisms for SQL sources, statement slots/indexes, and relation dialect runtimes (WeakSet/WeakMap-based provenance).
- Extends the query-site recognizer to optionally accept authenticated entrypoints, and introduces a one-way orchestration layer to combine CTE layout + query-site recognition safely.
- Updates CTE layout analysis to record provenance and to resolve authenticated entrypoints; expands tests and benchmarks to validate fail-closed behavior and ready paths.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/vnext/statement-index.ts | Tracks provenance and authenticates statement slot/index snapshots; hardens incremental update behavior when metadata/profile mismatches. |
| src/vnext/source.ts | Introduces authentication for package-created SqlSourceSnapshot objects. |
| src/vnext/relation-runtime-auth.ts | Adds runtime registration/authentication for coherent relation dialect runtime aggregates. |
| src/vnext/relation-query-site.ts | New orchestration entrypoint: authenticates runtime/source/slot, resolves authenticated CTE entrypoints, then delegates to the query-site recognizer. |
| src/vnext/relation-dialect.ts | Registers built-in relation dialect runtimes so they can be authenticated downstream. |
| src/vnext/query-site.ts | Adds entrypoint-aware internal recognizer and exports a new entrypoint-enabled API surface. |
| src/vnext/cte-layout.ts | Records provenance for layouts built from authenticated inputs and exposes entrypoint-resolution that fails closed on mixed/stale evidence. |
| src/vnext/tests/statement-index.test.ts | Adds tests for slot snapshot authentication behavior. |
| src/vnext/tests/source.test.ts | Adds tests for source snapshot authentication behavior. |
| src/vnext/tests/relation-dialect.test.ts | Adds tests ensuring only package-owned runtime aggregates authenticate. |
| src/vnext/tests/query-site.test.ts | Adds comprehensive tests for authenticated CTE main-query entrypoints and fail-closed behavior across dialects and hostile inputs. |
| src/vnext/tests/query-site.bench.ts | Adds benchmarks validating “ready” CTE paths and measuring double-scan orchestration cost. |
| src/vnext/tests/incremental-statement-index.test.ts | Adds regression tests for rebuild conditions and validates provenance across reused slot identities. |
| src/vnext/tests/cte-layout.test.ts | Updates fixtures for the new analyzeSqlCteLayout(source, index, slot, dialect) signature and adds cross-dialect coverage. |
| src/vnext/tests/cte-layout.bench.ts | Updates benchmarks to pass the statement index into CTE layout analysis. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 15 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/vnext/cte-layout.ts">
<violation number="1" location="src/vnext/cte-layout.ts:1591">
P2: Hostile dialect proxies can throw after successful dialect validation because provenance reads `dialect.lexicalProfile` directly. Use the already-safe `validatedDialect.lexicalProfile` for the slot provenance check so this path remains fail-closed.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| index, | ||
| slot, | ||
| source.analysisText, | ||
| dialect.lexicalProfile, |
There was a problem hiding this comment.
P2: Hostile dialect proxies can throw after successful dialect validation because provenance reads dialect.lexicalProfile directly. Use the already-safe validatedDialect.lexicalProfile for the slot provenance check so this path remains fail-closed.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/vnext/cte-layout.ts, line 1591:
<comment>Hostile dialect proxies can throw after successful dialect validation because provenance reads `dialect.lexicalProfile` directly. Use the already-safe `validatedDialect.lexicalProfile` for the slot provenance check so this path remains fail-closed.</comment>
<file context>
@@ -1561,6 +1582,57 @@ export function analyzeSqlCteLayout(
+ index,
+ slot,
+ source.analysisText,
+ dialect.lexicalProfile,
+ )
+ ) {
</file context>
Suggested change
| dialect.lexicalProfile, | |
| validatedDialect.lexicalProfile, |
Light2Dark
force-pushed
the
codex/vnext-cte-main-query
branch
from
July 25, 2026 03:47
c096a16 to
9ca185f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Correctness and trust boundaries
Verification
Part of #169.
Summary by cubic
Authenticate CTE main‑query entrypoints and only recognize relation query sites when the source, statement index, slot, and dialect all match. Ambiguous evidence fails closed, keeping the core recognizer independent; part of #169.
New Features
analyzeSqlCteLayout(source, index, slot, dialect)records provenance and binds main‑query entrypoints to the exact source/index/slot/dialect;resolveAuthenticatedSqlCteEntrypoints(...)exposes them safely.recognizeSqlRelationQuerySiteWithCteLayout(...)validates runtime/source/slot viaisSqlRelationDialectRuntime,isSqlSourceSnapshot, andisSqlStatementSlotSnapshot, then feeds authenticated entrypoints into the query‑site recognizer; runtimes are registered withregisterSqlRelationDialectRuntime.recognizeSqlRelationQuerySiteWithEntrypoints(...)matches SELECTs at the exact depth/offset for nested CTEs.buildSqlStatementIndexsnapshots the lexical profile;isExactSqlStatementSlotSnapshot(For)ensures slots belong to the index and text/profile;updateSqlStatementIndexrebuilds when text or lexical profile changes.Migration
analyzeSqlCteLayout(new signature:(source, index, slot, dialect)).recognizeSqlRelationQuerySiteWithCteLayoutwhen combining CTE layout with relation query‑site; keeprecognizeSqlRelationQuerySitefor non‑CTE cases.relation-dialectand authentic sources/slots produced by our builders.Written for commit 9ca185f. Summary will update on new commits.