Exact role reuse selected, final execution remains held
Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root explicitly selected reuse of the exact previously created role, preserving its name and reviewed target fingerprint, with fresh memory credential and bounded validity. This replaces the CREATE-only preparation blocker in the preceding memo. Root requested review of the final revised runner pin before production mutations; that hold remains in force. No role activation, grant, password change, environment write, deployment or signed approval occurred in this revision.
Fresh READ ONLY catalog evidence at 2026-10-03T08:18:17.030Z establishes exact role delivery_proof_audit_adr0053, OID 13362275, NOLOGIN, password NULL, NOSUPERUSER, NOBYPASSRLS, NOCREATEROLE, NOCREATEDB, NOINHERIT, NOREPLICATION, default connection limit and no role settings. All shared dependencies are empty, including ownership, direct ACL grants and policy dependencies. Existing role sessions are empty. Delivery schema USAGE/CREATE, audit SELECT/INSERT/destructive privileges and public schema CREATE are false. Unchanged PUBLIC-derived CONNECT/TEMP and public USAGE are recorded as baseline capabilities and cannot drift between preparation and activation. No shared or PUBLIC role is modified.
The expanded bidirectional membership check exposes one exact creator-administration link: granted role is the diagnostic role, member is postgres (OID 16388), grantor is supabase_admin (OID 10), ADMIN true, SET false, INHERIT false. The diagnostic role is not a member of any other role and grants no membership itself. PostgreSQL's primary role-attribute documentation describes this automatic grant back to a nonsuperuser creator. That is an explanation of the observed reverse link; the actual names, OIDs and options are independently read and pinned. The final gate accepts only this exact link, fails every additional or changed membership, and never alters it. Root's final review can assess this explicit observed owner-administration relation without a hidden exception.
Preflight verifies exact stopped-attempt provenance: final-stop SHA256 b207497c06a48f4ac6da67e3f661caacc6180766cd03ddf949dee62c6651417f and prior-state SHA256 e6de8f47063e57da79039f942456dec46676b3f599d82f269bf5b2e93f9bd86f. Prior signed approval and proof POST count are zero, role creation and revocation are retained, and planned unsigned UUID ebe659cf-6da2-4d35-9fa3-aa003ab0a762 differs from permanently stopped UUID 467b399c-e19c-40d3-829f-da3530ae300c. The fresh revoked-role readback is pinned at SHA256 c3ad7d9587772df42676000adbf08f3a901c6364f7fda4bdec47f82f1a1f8876 and repeated inside a READ ONLY preflight transaction.
The activation transaction rechecks that whole snapshot, including OID, flags, password absence, exact creator-admin direction, empty dependencies/sessions and unchanged capabilities, before recording activation start durably. It then grants only CONNECT on postgres, USAGE on delivery, SELECT/INSERT on delivery.delivery_audit_event, and sets only that exact role LOGIN with fresh in-memory SCRAM credential and VALID UNTIL no later than 30 minutes. It never CREATEs, DROPs or changes attributes of another role. Existing actual restricted-login, grant, ownership and five rollback-contained SQLSTATE 42501 denial probes remain required before key/window use. Cleanup uses the activation-start timestamp to attribute only this attempt's role sessions, revokes the same grants, clears password and login, and proves zero sessions. Transaction failure remains stopped and retains activation intent for exact-role teardown.
Final review pins in docs/adr0053-workload-proof/orchestration/:
fix-manifest.json:ccf7ff8c512c9b17a591cfc4ee6350ab52ce215c470951f04175534de6bce128.custody.mjs:0e1ec99fbf4895c23fef350feffd514461f538cd02065d969bba531d3341c8f7.role-reuse-plan.json:ed1281d70ad322c88ed6179d0df4657b97d1fab2042fc1a2b192a5654ab312eb.role-reuse.mjs:2d99b446010cba3db388feec395785d9252532f175ab2307551daa095da27153.role-reuse.test.mjs:64cea993e095f4a6b4bc24ae2747eadb9af117bef36ec3cac5f4f5aef02ac8d5.
The manifest includes the prior reviewed runner, exact local role-reuse delta, self-contained nonsecret role fixture and readback evidence. Combined recovery and role fixtures report 43 PASS. They reject changed OID, login/password/flags/settings, ownership, ACLs, existing sessions, additional memberships, creator SET/INHERIT or identity changes, audit/schema capabilities and PUBLIC drift. They also prove no grants/login before successful preconditions and start recording, no CREATE/DROP/shared-role write, and bounded credential validity. Syntax checks pass. The immediately preceding full Delivery validation passed 979 tests with 15 skipped, eight audit checks and typecheck; application runtime and packaged artifacts remain unchanged since that run.
READY cleanup dpl_6kMSVcQWqehL1sT6xAb78DjRrbPi, exact 5c36fd2021069d766b17f97032b4266c8d0b4f5a bytes, and diagnostic fb4bf54cf033cf47f2642bdcafe28e4498e5e951 artifact remain reusable subject to fresh preflight. The reviewed sequence still requires seven journaled temporary env entries, exact staged diagnostic checks, exact-ID removal and original business snapshot before promotion, at most one signed bounded acquisition invocation, immediate cleanup, role revoke/drain, route absence and honest retained-URL status, audit retention and expiry of that same approval. No Phase C or business mutation is introduced. G2 snapshots, prior evidence, old runtimes and both ADR deadlines remain preserved. Root retains final pin review, execution authority and sole canonical publication.