# P3-WP13 local fixture operations

The platform is intentionally inactive for enterprise plugins.  `plugin` stays
`TBD_EXTERNAL` and `enterprise_plugin_governance_owner` must approve the trust
model, signing CA, license policy, registry, sandbox profile and reviewers
before any non-fixture activation can be considered.

1. Run role-init before migration so it creates `dataops_plugin_platform_owner`
   and `dataops_plugin_platform_control` as NOLOGIN, non-superuser,
   non-CREATEROLE roles.  The migrator needs only membership in the owner role;
   runtime receives only the fixed runtime gateway; the independent configured
   control login receives only `plugin_platform_control_v5(jsonb)` and
   `plugin_platform_issue_claim_v3(jsonb)` (plus the separate recovery-claim
   gateway); v2 is explicitly revoked.
2. Upgrade with `MIGRATION_DATABASE_URL=<restricted-migrator-DSN>
   .venv/bin/alembic -c alembic.ini upgrade 20260818_559`.  It refuses missing
   roles and never creates roles itself.
3. The only accepted local distribution is `builtin_fixture` with fixture id
   `ENGINEERING_EVIDENCE_ONLY`, all network/file/secret/child-process values
   false, and the controlled trust-store key id `local-fixture-key-v1`.
4. Verify every role-init replay denies runtime direct table privileges for
   `plugin_registry_versions`, `plugin_approvals`, `plugin_runtime_leases`,
   `plugin_runs`, `plugin_dead_letters`, `plugin_audit_outbox`,
   `plugin_request_claims`, and `plugin_runtime_breakers`.  No raw
   input/output may enter facts or audits; retain hashes only.
5. A downgrade is permitted only with all WP13 facts empty. The first head
   downgrade checks registry review/incident links, approvals, leases, runs,
   dead letters, audits, invoke/recovery claims and breakers before it can
   expose a prior gateway. Any such row deliberately fails closed.

6. Lifecycle calls accept metadata/digests/fixture ids only.  They pass
   `draft→reviewed→approved→canary→active`; pause, rollback and revoke require
   a referenced existing `data_incidents` incident when that WP05 source table
   exists.  A state-changing approval is scope/actor/manifest/action/expiry
   bound and consumed exactly once.
7. Do not set an enterprise plugin to active.  This release permits an active
   local engineering fixture only inside the disposable test scope; external
   registry, signing CA, scanner, sandbox profile, source and notification
   providers remain disabled pending `plugin=TBD_EXTERNAL` resolution.
8. `plugin_platform_runtime_execute(jsonb)` is intentionally absent from head
   559. Never recreate or grant it. `plugin_platform_control_v2`,
   `plugin_platform_issue_claim`, and `plugin_platform_runtime_v2` are likewise
   sealed from callers. Dead-letter recovery must use only the
   separate control recovery-claim gateway with an unconsumed, unexpired,
   incident-bound approval; the runtime gateway consumes that claim once.

Use `TEST_DATABASE_URL=<local-admin-DSN> PYTHONPATH=. .venv/bin/pytest -q
tests/integration/test_wp13_plugin_platform_postgres.py` for the disposable
database check.  It creates UUID-named databases/roles only and removes them.