orneryd / NornicDB / 36361025095

87%

Build Type

push

github

Committed by orneryd

Commit Message

fix(cypher,server): close Cypher convergence and lane-3 security gaps (#521)

Close the 35-issue Cypher convergence program from the private security
review of main (lane 3) and attach the qualification evidence.

- Run one-statement transaction scripts (BEGIN ... COMMIT/ROLLBACK) on a
  private executor instead of the shared per-database executor, so a client
  statement can no longer collide with concurrent auto-commit statements.
- Treat pattern comprehensions and COUNT { }/EXISTS { } subqueries as graph
  access for the composite-root guard.
- Scope :param/:params per authenticated caller instead of shared executor
  state.
- Classify and route CREATE OR REPLACE DATABASE as an admin command
  (drop then create).
- Truncate logged query shapes at rune boundaries.
- Attach failing-baseline and fixing commits to all 35 ledger entries and
  record the TCK ratchet (7794/7794), full-suite, build, scoped-race and
  routing-benchmark qualification in the issue ledger.
- Sync parser-mode and Cypher-compatibility docs with the converged single
  pipeline; multi-database support is documented as implemented.

Leaves #472 and #473 open: they belong to the separate backup/restore
workstream per the issue matrix.

Closes #447, #448, #449, #450, #451, #452, #453, #454, #455, #456, #457,
#458, #459, #460, #461, #462, #463, #464, #465, #466, #467, #468, #469,
#470, #471, #474, #475, #476, #477, #478, #479, #480, #481, #482, #487,
#521

Coverage Stats

210 of 305 new or added lines in 11 files covered. (68.85%)

23 existing lines in 9 files now uncovered.

175086 of 201294 relevant lines covered (86.98%)

1.02 hits per line