fix(data): retire legacy auth tables from clean bootstrap

[seonghobae]

Purpose

Execute issue #150 as a non-destructive first slice: stop creating abandoned local-auth tables in new default Docker PostgreSQL installations while preserving an explicit opt-in compatibility artifact for installations that still require the historical schema. Existing PostgreSQL volumes are intentionally not destructively migrated here.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/retire-legacy-auth-bootstrap;
• exact current head: 50c7211dd1f80098ecec1069eebcedb8d4a5e96a;
• current synthetic merge: f65c9305cf2e6d2618ccfff6052bb7cade2f5b3b;
• Draft: true;
• GitHub mergeability: true;
• unresolved review threads: zero;
• formal reviews: none.

Every old-head check/review is stale and does not transfer.

Consumer-inventory RCA

Protected source inspection finds users, roles, and user_roles created by docker/postgres/init/01_schema.sql, but no shipped local authentication controller/runtime SQL path that requires them. Organization-wide public-code search did not find a separate public consumer. That narrows the likely blast radius but does not prove absence of private or external consumers, so silent DROP/rename is rejected.

Chosen bounded remedy:

• new default clean installs stop creating the abandoned objects;
• docker/postgres/compat/legacy_auth_tables.sql preserves the historical schema only as an explicit deprecated compatibility artifact outside docker/postgres/init/;
• shipped Compose does not execute that compatibility artifact automatically;
• existing initialized volumes are left unchanged;
• no new authentication model or leapfrogging Flyway migration is invented.

TDD

Creation head 1adaa2bfda57411569b45b379ec4ebe1628219a9 added LegacyAuthBootstrapRetirementTest before the bootstrap/compatibility files changed. A later audit found the first repair still lacked authoritative recovery/compatibility evidence, so e89ef37720bf635d4e858301a523edf8ae5b50f6 extended the test first to require an operator runbook and changelog contract.

The branch then:

• removed the historical objects from the default clean-install bootstrap;
• added docker/postgres/compat/legacy_auth_tables.sql outside the default init path;
• added docs/data/legacy-auth-bootstrap-retirement.md documenting clean-install behavior, untouched existing volumes, explicit compatibility restoration, rollback/forward recovery, external-consumer uncertainty, and data-security boundaries;
• recorded the compatibility-impacting clean-install change in CHANGELOG.md.

Remaining database-realism boundary

This PR deliberately does not claim that static SQL/source assertions prove a safe destructive migration of existing PostgreSQL volumes. Issue #150's full retirement acceptance requires private/external consumer inventory plus representative real-PostgreSQL upgrade/rollback or forward-recovery rehearsal before any future DROP/rename. Adding a new Flyway version here would collide with the active durable-job migration stack and create false sequencing authority, so it is rejected for this slice.

Current workflow evidence and source identity

All exposed aggregate workflows associated with exact source head 50c7211dd1f80098ecec1069eebcedb8d4a5e96a completed successfully:

• CI 31314123991: success;
• Dependency Review 31314123965: success;
• CycloneDX SBOM 31314123967: success;
• SAST Semgrep 31314124017: success;
• Security Scan 31314123984: success;
• CodeRabbit source-head commit status: success.

These aggregate greens are not accepted as literal-source proof under mightyETL's exact-source governance. CI macOS job 93246494460 used ordinary actions/checkout with no explicit source ref, fetched f65c9305cf2e6d2618ccfff6052bb7cade2f5b3b as refs/remotes/pull/155/merge, and checked out that synthetic merge (Merge 50c7211... into 622e5e6...) before running the reactor. The job itself was healthy: it ran LegacyAuthBootstrapRetirementTest 3/3 green, the etl-service suite reported 278 tests with zero failures/errors/skips, CDC reported 106/0/0/0, gateway 3/0/0/0, and the reactor finished BUILD SUCCESS. This is strong merged-tree compatibility evidence, but it cannot be relabeled literal-head source evidence.

The same current CI log exposes an independent shared protected-base quality-gate defect: JaCoCo report-durable-job-coverage logged Analyzed bundle 'etl-service' with 0 classes, and check-durable-job-coverage then logged All coverage checks have been met. Therefore this CI success is also not valid 100% owned-production coverage evidence. Issue #162 records the RCA and acceptance contract; active Draft PR #164 repairs the filter semantics and adds a non-empty selected-class invariant. No #164 checks or future coverage results transfer to this PR after any head/base change.

The current protected source-executing workflows predate #121's explicit source-head checkout controls. No qualifying independent non-author formal APPROVED review exists on this exact head. Therefore this PR remains Draft and not merge-eligible even though aggregate workflows are green.

Scope guard

Do not combine this PR with gateway #142, canonical documentation #149, licensing issue #151, #162/#164 coverage repair, or the durable-job stack. Do not treat the compatibility artifact as a supported authentication product or silently auto-create it at runtime. After literal-source and non-vacuous coverage controls integrate, rerun the unchanged head against the resulting protected base and regenerate every affected check/review; predecessor, synthetic-merge, and other-PR evidence does not transfer.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c311878-6bcf-4086-a5b2-6137b2dbb139

📥 Commits

Reviewing files that changed from the base of the PR and between 622e5e6 and 50c7211.

📒 Files selected for processing (5)

• CHANGELOG.md
• docker/postgres/compat/legacy_auth_tables.sql
• docker/postgres/init/01_schema.sql
• docs/data/legacy-auth-bootstrap-retirement.md
• etl-service/src/test/java/com/xtrmetl/etl/documentation/LegacyAuthBootstrapRetirementTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.