fix(compose): postgres init RLS syntax for F21 smoke (#151)

Fix invalid FOR ALL TO ALL RLS policies in scripts/db/init.sql that caused postgres docker-entrypoint-initdb.d to exit 3 during F21 compose smoke. Also split ledger DB, fix ledger ESM/healthcheck, ship abac.yaml, and scope F21 --wait to core services.

Author: fraware

.github/workflows/integration.yaml

@@ -10,11 +10,17 @@ on:
       - "runtime/**"
       - "tests/integration/**"
       - ".github/workflows/integration.yaml"
+      - "docker-compose.yml"
+      - "scripts/db/**"
+      - "scripts/docker-compose-smoke.sh"
   pull_request:
     paths:
       - "runtime/**"
       - "tests/integration/**"
       - ".github/workflows/integration.yaml"
+      - "docker-compose.yml"
+      - "scripts/db/**"
+      - "scripts/docker-compose-smoke.sh"
 
 jobs:
   integration:

docker-compose.yml

@@ -21,6 +21,7 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./scripts/db/init.sql:/docker-entrypoint-initdb.d/init.sql
+      - ./scripts/db/init-ledger-db.sh:/docker-entrypoint-initdb.d/init-ledger-db.sh
     ports:
       - "5432:5432"
     healthcheck:
@@ -200,7 +201,7 @@ services:
       - PORT=4000
       - PF_ENFORCE_DSSE=1
       - PF_ENABLED_TOOLS=
-      - DATABASE_URL=postgresql://sentinelops:sentinelops_password@postgres:5432/sentinelops?schema=public
+      - DATABASE_URL=postgresql://sentinelops:sentinelops_password@postgres:5432/ledger?schema=public
       - SIDECAR_URL=http://runtime-sidecar:8006
     depends_on:
       postgres:

runtime/ledger/Dockerfile

@@ -19,7 +19,7 @@ FROM node:20-bookworm-slim AS runner
 
 WORKDIR /app
 
-RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
+RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /app/dist ./dist

runtime/ledger/src/auth.ts

@@ -6,6 +6,8 @@ import { expressjwt as jwt } from 'express-jwt'
 import jwksRsa from 'jwks-rsa'
 import { PrismaClient } from '@prisma/client'
 import type { PeerCertificate } from 'tls'
+import https from 'node:https'
+import crypto from 'node:crypto'
 
 const prisma = new PrismaClient()
 
@@ -28,11 +30,11 @@ export const authMiddleware = jwt({
     jwksRequestsPerMinute: 5,
     jwksUri: process.env.JWKS_URI || `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
     // Add certificate chain pinning
-    requestAgent: new (require('https').Agent)({
+    requestAgent: new https.Agent({
       checkServerIdentity: (host: string, cert: PeerCertificate) => {
         // Certificate chain pinning validation
         const expectedPins = process.env.CERTIFICATE_PINS?.split(',') || [];
-        const certFingerprint = require('crypto')
+        const certFingerprint = crypto
           .createHash('sha256')
           .update(cert.raw)
           .digest('base64');

runtime/ledger/src/mcp/mcp-proxy.ts

@@ -10,10 +10,10 @@ import { Request, Response, NextFunction } from 'express';
 import { PrismaClient } from '@prisma/client';
 import winston from 'winston';
 import axios from 'axios';
-import { ToolSignatureManager } from './tool-signature-manager';
-import { CertificateManager } from './certificate-manager';
-import { EgressProfileManager } from './egress-profile-manager';
-import { JCSValidator } from './jcs-validator';
+import { ToolSignatureManager } from './tool-signature-manager.js';
+import { CertificateManager } from './certificate-manager.js';
+import { EgressProfileManager } from './egress-profile-manager.js';
+import { JCSValidator } from './jcs-validator.js';
 import type {
   JsonRpcRequest,
   PolicyEnforcementResult,

runtime/ledger/src/profiles/production.ts

@@ -5,7 +5,7 @@ import { PrismaClient } from '@prisma/client'
 import express from 'express'
 import { ApolloServer } from '@apollo/server'
 import { expressMiddleware } from '@apollo/server/express4'
-import { json } from 'body-parser'
+import bodyParser from 'body-parser'
 import cors from 'cors'
 import winston from 'winston'
 import {
@@ -52,7 +52,7 @@ export async function startProductionProfile(): Promise<void> {
   await mcpService.initialize()
 
   app.use(cors())
-  app.use(json())
+  app.use(bodyParser.json())
 
   registerRestRoutes(app, {
     prisma,

runtime/retrieval-gateway/Dockerfile

@@ -21,6 +21,8 @@ RUN cargo build --release -p retrieval-gateway
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget \
     && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY runtime/retrieval-gateway/abac.yaml ./abac.yaml
 COPY --from=builder /app/target/release/retrieval-gateway /usr/local/bin/
 EXPOSE 8080
 ENV PORT=8080

scripts/db/init-ledger-db.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2025 SentinelOps Platform Contributors
+#
+# Ledger Prisma migrate deploy requires an empty database. Platform tables from
+# init.sql live in POSTGRES_DB (sentinelops); ledger uses a separate database.
+
+set -euo pipefail
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
+    CREATE DATABASE ledger;
+    GRANT ALL PRIVILEGES ON DATABASE ledger TO ${POSTGRES_USER};
+EOSQL

scripts/db/init.sql

@@ -37,7 +37,7 @@ ALTER TABLE certificates ENABLE ROW LEVEL SECURITY;
 
 -- Create RLS policy for tenant isolation
 CREATE POLICY tenant_isolation ON certificates
-    FOR ALL TO ALL
+    FOR ALL
     USING (tenant_id = current_setting('app.current_tenant', true));
 
 -- Create audit_logs table for hash chain
@@ -63,7 +63,7 @@ CREATE INDEX IF NOT EXISTS idx_audit_logs_hash ON audit_logs(hash);
 ALTER TABLE audit_logs ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY audit_tenant_isolation ON audit_logs
-    FOR ALL TO ALL
+    FOR ALL
     USING (tenant_id = current_setting('app.current_tenant', true));
 
 -- Create policy_versions table
@@ -94,7 +94,7 @@ CREATE INDEX IF NOT EXISTS idx_policy_versions_status ON policy_versions(status)
 ALTER TABLE policy_versions ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY policy_tenant_isolation ON policy_versions
-    FOR ALL TO ALL
+    FOR ALL
     USING (tenant_id = current_setting('app.current_tenant', true));
 
 -- Create epochs table
@@ -117,7 +117,7 @@ CREATE INDEX IF NOT EXISTS idx_epochs_created_at ON epochs(created_at);
 ALTER TABLE epochs ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY epoch_tenant_isolation ON epochs
-    FOR ALL TO ALL
+    FOR ALL
     USING (tenant_id = current_setting('app.current_tenant', true));
 
 -- Create replay_jobs table
@@ -147,7 +147,7 @@ CREATE INDEX IF NOT EXISTS idx_replay_jobs_started_at ON replay_jobs(started_at)
 ALTER TABLE replay_jobs ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY replay_tenant_isolation ON replay_jobs
-    FOR ALL TO ALL
+    FOR ALL
     USING (tenant_id = current_setting('app.current_tenant', true));
 
 -- Insert sample data for demo

scripts/docker-compose-smoke.sh

@@ -27,7 +27,12 @@ fi
 $COMPOSE config >/dev/null
 echo "compose config: OK"
 
-$COMPOSE up -d --wait --timeout 180
+# Long-running services exercised by this smoke (health curls below). Omit batch CLIs,
+# demo apps, and platform microservices not required for compose/DB validation.
+SMOKE_SERVICES=(
+  postgres redis runtime-sidecar ledger retrieval-gateway
+)
+$COMPOSE up -d --wait --timeout 180 "${SMOKE_SERVICES[@]}"
 echo "compose up --wait: OK"
 
 # Health endpoints for core services in full profile