feat(safegres): anon-role split, sealed runs, and an evaluation corpus

[pyramation]

Summary

Three pieces, in the order they depend on each other: the exposure surface learns which roles are anonymous, a run learns to state which ruler it was measured with, and the package ships schemas whose answers are known.

1. anonRoles — the surface's missing distinction. The Constructive adapter reads both role_name and anon_role per API and flattened them into one roles list, so rolesFrom: 'exposure' would have pointed R1/R2 at authenticated and turned every ordinary signed-in write grant into a critical. A plane now carries both:

interface PlaneInput {
  roles?: string[];      // every role that reaches this plane
  anonRoles?: string[];  // the subset an *unauthenticated* caller arrives as
}
// rules choose: rolesFrom: 'anon' | 'exposure'

Per adapter: Constructive anon_role only; PostgREST pgrst.db_anon_role (never the authenticator); Supabase anon but not authenticated; Graphile's visitor role, which carries anonymous traffic by design. recommended now points R1/R2/L5 at rolesFrom: 'anon', so a declared exposure.anonRoles switches them on and an undeclared surface leaves them inert exactly as before.

2. Sealed runs. Every configuration knob is deliberate in CI and is the cheapest possible cheat when a score is what's being evaluated — turning off the rule and re-baselining both raise the number without touching the database. So every report now carries provenance: { version, fingerprint, sealed, preset }, where the fingerprint is sha256 over the resolved score-relevant surface (rules × enabled × severity × options, overrides, scoring, public-read, perf ignores, exposure + adapter names, version) — invariant to how a posture was spelled, sensitive to anything that changes it. --sealed skips config discovery entirely and refuses --config/--rule/--exposure-schemas/baseline flags rather than ignoring them; --verify-fingerprint <f> exits non-zero unless the run matches the harness's expectation.

3. The evaluation corpus (corpus/). A sealed score says the ruler didn't move; it doesn't say the ruler is right. 23 small schemas, one deliberate flaw each, with an answer key as data (schema.sql + case.json: expected findings, forbidden false positives, worst severity, the one-sentence fix) so a harness can consume it without running safegres. loadCorpus() / gradeCase(report, case) grade recall and precision; __tests__/corpus.test.ts runs all of them and additionally pins that a flaw costs points exactly when the rule carries weight (info and fail-closed rules are weightless by construction).

Writing the corpus found two real bugs, both fixed here:

• P1b never fired on the common shape. It was emitted inside the volatility === 'v' branch, so only a VOLATILE SECURITY DEFINER function was reported — yet the rule is about inlining, and a STABLE definer wrapper is just as much a plan fence. Now checked before the volatility filter. This can surface new (medium, perf-dimension) findings on existing databases.
• A5/A1 case authoring, not a bug but worth knowing: fail-closed rules and info severities deduct nothing, which the corpus now asserts explicitly rather than leaving implicit.

Also: configurable job-summary detail (report.github.detail: 'summary' | 'normal' | 'verbose') — GitHub truncates a job summary at 1 MB, and a truncated report is worse than a short one, so summary keeps the badges and the ratchet verdict and drops the finding tables.

Related: the deeper reachability work this unblocks is designed in constructive-io/constructive-planning#1361.

Link to Devin session: https://app.devin.ai/sessions/b7874ecee0c7471ea271e6e7193869dc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring