v0.3.3-pre.009

crates/ksp-store-postgres-lib/tests/hardening_completeness.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-store-postgres-lib/tests/hardening_completeness.rs
-// version: 8
+// version: 9
 
 #![warn(missing_docs)]
 #![deny(unreachable_pub)]
@@ -230,3 +230,28 @@ fn pre_009_backend_has_no_env_bypass_reverse_facade_edge_or_raw_account_trait_im
     }
     return;
 }
+
+#[test]
+fn pre_009_live_raw_transaction_proof_is_opt_in_isolated_and_secret_safe() {
+    let live = include_str!("postgres_raw_transaction_live.rs");
+    for required in [
+        "#[ignore = \"opt-in real PostgreSQL RawTransaction proof; reads one dedicated URI from stdin\"]",
+        "std::io::stdin().read_line",
+        "managed_schema_preexisting_refusal",
+        "prove_schema_update_policy",
+        "prove_concurrent_identical_insert",
+        "prove_concurrent_divergent_insert",
+        "prove_pagination",
+        "prove_retention_and_rehydrate",
+        "prove_retention_races",
+        "prove_cancellation_rollback",
+        "task.abort()",
+        "cleanup_verification",
+    ] {
+        assert!(live.contains(required), "missing pre.009 live proof guard/scenario: {required}");
+    }
+    for forbidden in ["std::env", "KSP_SECRET_", "PGPASSWORD", "connection_uri = %", "connection_uri = ?", "println!(uri", "eprintln!(uri"] {
+        assert!(!live.contains(forbidden), "pre.009 live proof contains forbidden secret/environment material: {forbidden}");
+    }
+    return;
+}