DataOps-platform/docs/runbooks/P3_WP13_GOVERNED_PLUGIN_PLATFORM_OPERATIONS.md

P3-WP13 local fixture operations

The platform is intentionally inactive for enterprise plugins. plugin stays TBD_EXTERNAL and enterprise_plugin_governance_owner must approve the trust model, signing CA, license policy, registry, sandbox profile and reviewers before any non-fixture activation can be considered.

1. Run role-init before migration so it creates dataops_plugin_platform_owner and dataops_plugin_platform_control as NOLOGIN, non-superuser, non-CREATEROLE roles. The migrator needs only membership in the owner role; runtime receives only the fixed runtime gateway; the independent configured control login receives only plugin_platform_control_v5(jsonb) and plugin_platform_issue_claim_v3(jsonb) (plus the separate recovery-claim gateway); v2 is explicitly revoked.
2. Upgrade with MIGRATION_DATABASE_URL=<restricted-migrator-DSN> .venv/bin/alembic -c alembic.ini upgrade 20260818_559. It refuses missing roles and never creates roles itself.
3. The only accepted local distribution is builtin_fixture with fixture id ENGINEERING_EVIDENCE_ONLY, all network/file/secret/child-process values false, and the controlled trust-store key id local-fixture-key-v1.
4. Verify every role-init replay denies runtime direct table privileges for plugin_registry_versions, plugin_approvals, plugin_runtime_leases, plugin_runs, plugin_dead_letters, plugin_audit_outbox, plugin_request_claims, and plugin_runtime_breakers. No raw input/output may enter facts or audits; retain hashes only.

5. A downgrade is permitted only with all WP13 facts empty. The first head downgrade checks registry review/incident links, approvals, leases, runs, dead letters, audits, invoke/recovery claims and breakers before it can expose a prior gateway. Any such row deliberately fails closed.

6. Lifecycle calls accept metadata/digests/fixture ids only. They pass draft→reviewed→approved→canary→active; pause, rollback and revoke require a referenced existing data_incidents incident when that WP05 source table exists. A state-changing approval is scope/actor/manifest/action/expiry bound and consumed exactly once.

7. Do not set an enterprise plugin to active. This release permits an active local engineering fixture only inside the disposable test scope; external registry, signing CA, scanner, sandbox profile, source and notification providers remain disabled pending plugin=TBD_EXTERNAL resolution.

8. plugin_platform_runtime_execute(jsonb) is intentionally absent from head

   1. Never recreate or grant it. plugin_platform_control_v2, plugin_platform_issue_claim, and plugin_platform_runtime_v2 are likewise sealed from callers. Dead-letter recovery must use only the separate control recovery-claim gateway with an unconsumed, unexpired, incident-bound approval; the runtime gateway consumes that claim once.

Use TEST_DATABASE_URL=<local-admin-DSN> PYTHONPATH=. .venv/bin/pytest -q tests/integration/test_wp13_plugin_platform_postgres.py for the disposable database check. It creates UUID-named databases/roles only and removes them.