david/pi-extensions-and-skills
Watch
1
0
Fork
You've already forked pi-extensions-and-skills
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MSSQL spike: write RESULT.md, apply the gate, open the Stage 1 PR #318

New issue
Closed
opened 2026-11-10 08:19:06 +00:00 by david · 2 comments
david commented 2026-11-10 08:19:06 +00:00
Owner
Copy link

Summary

Record the spike scores and dependency results in extensions/mssql/spike/RESULT.md, name a winner or record a stop, and open the Stage 1 PR.

Background

This is the Stage 1 gate. Pass rule: zero false accepts, then maximum accepts; no minimum accept rate. If neither candidate has zero false accepts, stop: do not start Stage 2, report to the repo owner, and the owner decides the next design (options named in the design: Microsoft ScriptDOM through a .NET helper, a custom tokenizer on the best parser, or another design). Stage 2 issues (milestones M4 to M8) are blocked until this gate passes. Zero false accepts on a finite corpus does not prove the parser is safe ([SECURITY RISK]); RESULT.md must say so.

Depends on: #317

Implementation Details

  1. Run node extensions/mssql/spike/run.mjs from a clean checkout and paste the scores (false accepts with labels, accepts, rejected-accepts) into extensions/mssql/spike/RESULT.md.
  2. Include the dependency check results (link to dependency-check.md) and the CI test coverage finding.
  3. State the winner, or STOP with the reason. Add a "Residual risk" paragraph: a finite corpus cannot prove safety; the parser is the only write block; recommend a read-only database login ([BEST PRACTICE]).
  4. Open the Stage 1 PR. Follow AGENTS.md: branch feature/issue-<N>/<slug>, commits issue-<N>: <summary>, PR title issue-<N>: <title>, body Closes #<N>. Do not merge: ask the repo owner. Do not register anything in the root package.json.
  5. If the result is STOP, comment on the Stage 2 issues (M4 to M8) and tell the owner; do not start them.

Acceptance Criteria

  • RESULT.md has scores for both candidates, with false-accept labels listed.
  • RESULT.md names a winner with zero false accepts, or records the STOP.
  • RESULT.md includes dependency check results and the residual-risk paragraph.
  • The runner runs from a clean checkout.
  • The Stage 1 PR is open, closes this issue, and is not merged by the agent.

Test Plan

Clone fresh, install the documented spike deps, run node extensions/mssql/spike/run.mjs, and confirm the numbers in RESULT.md match the output.

## Summary Record the spike scores and dependency results in `extensions/mssql/spike/RESULT.md`, name a winner or record a stop, and open the Stage 1 PR. ## Background This is the Stage 1 gate. Pass rule: zero false accepts, then maximum accepts; no minimum accept rate. **If neither candidate has zero false accepts, stop: do not start Stage 2, report to the repo owner, and the owner decides the next design** (options named in the design: Microsoft ScriptDOM through a .NET helper, a custom tokenizer on the best parser, or another design). Stage 2 issues (milestones M4 to M8) are blocked until this gate passes. Zero false accepts on a finite corpus does not prove the parser is safe ([SECURITY RISK]); `RESULT.md` must say so. **Depends on:** #317 ## Implementation Details 1. Run `node extensions/mssql/spike/run.mjs` from a clean checkout and paste the scores (false accepts with labels, accepts, rejected-accepts) into `extensions/mssql/spike/RESULT.md`. 2. Include the dependency check results (link to `dependency-check.md`) and the CI test coverage finding. 3. State the winner, or `STOP` with the reason. Add a "Residual risk" paragraph: a finite corpus cannot prove safety; the parser is the only write block; recommend a read-only database login ([BEST PRACTICE]). 4. Open the Stage 1 PR. Follow `AGENTS.md`: branch `feature/issue-<N>/<slug>`, commits `issue-<N>: <summary>`, PR title `issue-<N>: <title>`, body `Closes #<N>`. Do not merge: ask the repo owner. Do not register anything in the root `package.json`. 5. If the result is STOP, comment on the Stage 2 issues (M4 to M8) and tell the owner; do not start them. ## Acceptance Criteria - [ ] `RESULT.md` has scores for both candidates, with false-accept labels listed. - [ ] `RESULT.md` names a winner with zero false accepts, or records the STOP. - [ ] `RESULT.md` includes dependency check results and the residual-risk paragraph. - [ ] The runner runs from a clean checkout. - [ ] The Stage 1 PR is open, closes this issue, and is not merged by the agent. ## Test Plan Clone fresh, install the documented spike deps, run `node extensions/mssql/spike/run.mjs`, and confirm the numbers in `RESULT.md` match the output.
david closed this issue 2026-11-10 23:12:40 +00:00
david commented 2026-11-10 23:12:40 +00:00
Author
Owner
Copy link

pi-loop opened and merged a pull request for this issue: #340

pi-loop opened and merged a pull request for this issue: https://git.excelera.net/david/pi-extensions-and-skills/pulls/340
david commented 2026-11-10 23:46:59 +00:00
Author
Owner
Copy link

Outcome note: gate resolved as STOP, superseded by ADR 0002

Spike result: neither candidate reached zero false accepts, so the Stage 1 gate stopped the parser-based design. See extensions/mssql/spike/RESULT.md.

Candidate False accepts Accepts
A: node-sql-parser 5.4.0 3 55 / 60
B: ANTLR4 T-SQL grammar 2 60 / 60

Follow-up decision: docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md (merged in #341).

  • Read-only database credentials are the write control.
  • The guard is a minimal, dependency-free accident check. It is not a security boundary, and it adds no parser, Java or .NET dependency.
  • A startup check warns when the login appears to have write access. It never blocks.

Docs updated in #341: extensions/mssql/docs/DESIGN.md and extensions/mssql/docs/IMPLEMENTATION_PLAN.md.

Stage 2 tracker changes:

Stage 2 is unblocked. The spike directory stays as a record. Removing its generated grammar output is an open item in DESIGN.md.

## Outcome note: gate resolved as STOP, superseded by ADR 0002 **Spike result:** neither candidate reached zero false accepts, so the Stage 1 gate stopped the parser-based design. See `extensions/mssql/spike/RESULT.md`. | Candidate | False accepts | Accepts | | --- | --- | --- | | A: `node-sql-parser` 5.4.0 | 3 | 55 / 60 | | B: ANTLR4 T-SQL grammar | 2 | 60 / 60 | **Follow-up decision:** `docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md` (merged in #341). - Read-only database credentials are the write control. - The guard is a minimal, dependency-free accident check. It is not a security boundary, and it adds no parser, Java or .NET dependency. - A startup check warns when the login appears to have write access. It never blocks. **Docs updated in #341:** `extensions/mssql/docs/DESIGN.md` and `extensions/mssql/docs/IMPLEMENTATION_PLAN.md`. **Stage 2 tracker changes:** - New issue #342 covers the write-access check and warning. - Issues #319, #322, #323, #329 and #331 were rewritten to match the ADR. - Issues #320, #321, #324, #325, #326, #327, #328 and #330 have a comment saying the "blocked until the gate passes" note is superseded. Stage 2 is unblocked. The spike directory stays as a record. Removing its generated grammar output is an open item in `DESIGN.md`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feature/issue-342/mssql-write-access-check-and-startup-warning-never
feature/issue-331/mssql-write-extensions-mssql-readme-md-setup-tools
feature/issue-330/mssql-register-extension-add-tests-to-root-test-sc
feature/issue-329/mssql-index-ts-wiring-load-env-refuse-on-invalid-l
feature/issue-328/mssql-mssql-table-schema-tool-parameterised
feature/issue-327/mssql-mssql-list-tables-tool
feature/issue-326/mssql-mssql-query-and-mssql-query-one-tools
feature/issue-325/mssql-stream-runner-with-row-cap-cancel-and-timeou
feature/issue-324/mssql-pool-config-builder-encrypt-on-certificate-s
feature/issue-323/mssql-audit-log-writer-pi-mssql-audit-log-mode-060
feature/issue-322/mssql-read-only-guard-module-validatesql-with-corp
feature/issue-321/mssql-certificate-trust-setting-and-limit-validati
feature/issue-320/mssql-loadenvfile-and-mssql-url-parsing
feature/issue-319/mssql-extension-skeleton-permanent-corpora-and-dep
feature/issue-318/mssql-spike-write-result-md-apply-the-gate-open-th
feature/issue-317/mssql-spike-scoring-runner-for-both-candidates
feature/issue-316/mssql-spike-candidate-b-guard-using-the-antlr4-t-s
feature/issue-315/mssql-spike-candidate-a-guard-using-node-sql-parse
feature/issue-314/mssql-spike-must-accept-corpus
feature/issue-313/mssql-spike-scaffold-spike-directory-and-must-reje
feature/issue-311/mssql-spike-check-dependencies-mssql-node-sql-pars
feature/issue-312/mssql-spike-check-whether-extension-tests-run-in-c
feature/issue-299/verify-the-ste-style-live-in-a-short-grill-session
feature/issue-298/bump-the-grillme-extension-to-0-4-0-and-add-the-ch
feature/issue-297/rewrite-extensions-grillme-design-md-in-ste-style
feature/issue-296/rewrite-extensions-grillme-readme-md-in-ste-style
feature/issue-295/rewrite-the-grill-me-command-output-and-read-only
feature/issue-294/rewrite-the-grill-me-tool-metadata-to-the-ste-rule
feature/issue-293/extract-buildgrillprompt-and-add-the-prompt-integr
feature/issue-292/add-ste-style-test-ts-checks-for-the-rule-text-and
feature/issue-291/add-the-pure-ste-style-ts-module-and-inject-the-st
feature/issue-264/verify-the-vision-tool-live-against-the-deepseek-a
feature/issue-263/list-the-vision-extension-in-the-repo-root-readme
feature/issue-262/write-extensions-vision-readme-md-the-10-section-p
feature/issue-261/wire-the-vision-extension-into-package-json-manife
feature/issue-260/implement-extensions-vision-index-ts-factory-regis
feature/issue-258/implement-extensions-vision-src-tool-ts-the-vision
feature/issue-257/implement-extensions-vision-src-client-ts-request
feature/issue-256/implement-extensions-vision-src-usage-ts-usage-map
feature/issue-255/implement-extensions-vision-src-images-ts-read-val
feature/issue-254/implement-extensions-vision-src-config-ts-env-reso
feature/issue-253/implement-extensions-vision-src-errors-ts-toolerro
feature/issue-252/penpot-add-text-stages-zero-area-auto-width-text-p
feature/issue-216/add-the-penpot-skill-and-extension-to-the-repo-roo
feature/issue-217/register-the-penpot-tests-in-npm-test-complete-the
feature/issue-215/write-the-penpot-skill-md-core-workflow-token-conv
feature/issue-214/implement-and-run-fetch-penpot-docs-mjs-and-commit
feature/issue-213/validate-screenshot-reconstruction-against-the-liv
feature/issue-212/add-the-image-to-design-workflow-to-skills-penpot
feature/issue-211/validate-svg-import-icon-and-illustration-against
feature/issue-210/implement-the-penpot-add-svg-tool-with-svg-raw-fal
feature/issue-209/implement-the-svg-to-shapes-converter-in-src-svg-t
feature/issue-208/validate-component-instancing-against-the-live-ins
feature/issue-207/implement-penpot-instance-component-with-id-remapp
feature/issue-206/author-and-commit-the-component-library-artifact-u
feature/issue-205/implement-file-library-linking-and-validate-the-ex
feature/issue-204/implement-penpot-export-library-sse-uri-plus-artif
feature/issue-203/implement-penpot-import-library-multipart-upload-p
feature/issue-202/implement-the-transit-decoder-and-sse-stream-parse
feature/issue-201/validate-a-full-composed-screen-one-commit-one-rev
feature/issue-200/implement-penpot-add-image-with-media-upload
feature/issue-199/implement-asset-reference-resolution-plus-penpot-a
feature/issue-198/implement-penpot-add-frame-with-auto-layout-props
feature/issue-197/validate-asset-creation-atomicity-and-write-safety
feature/issue-196/implement-the-designated-target-write-guard-with-a
feature/issue-195/implement-penpot-commit-with-revn-tracking-conflic
feature/issue-194/implement-the-staged-changeset-store-and-the-colou
feature/issue-193/validate-read-primitives-against-the-live-penpot-i
feature/issue-192/implement-the-penpot-list-library-tool-with-name-t
feature/issue-191/implement-the-penpot-get-file-tool-pages-objects-a
feature/issue-190/implement-the-penpot-list-projects-tool-teams-and
feature/issue-189/implement-the-penpot-whoami-tool-and-wire-the-exte
feature/issue-188/implement-the-rpc-client-and-error-decoding-in-src
feature/issue-187/implement-penpot-url-penpot-token-resolution-in-sr
feature/issue-186/scaffold-the-penpot-extension-directory-and-regist
feature/issue-172/add-end-to-end-main-tests-for-the-fj-rg-tool-state
feature/issue-171/make-reminder-report-dynamic-install-skip-counts-r
feature/issue-170/wire-settings-json-filter-rewrite-into-dedupeandre
feature/issue-169/implement-buildpackagefilters-with-exhaustive-unit
feature/issue-168/refactor-preflight-to-skip-warn-for-missing-fj-rg
feature/issue-167/add-fj-rg-tool-detection-helpers-rgavailable-detec
feature/issue-148/reconcile-design-md-and-implementation-plan-with-t
feature/issue-146/verify-extension-load-behavior-with-and-without-mo
feature/issue-145/write-extensions-mongodb-readme-md
feature/issue-144/write-tool-description-promptsnippet-guidance-for
feature/issue-143/implement-index-ts-async-factory-lifecycle-with-te
feature/issue-142/implement-the-mongo-list-collections-tool-with-uni
feature/issue-141/implement-the-mongo-count-tool-with-unit-tests
feature/issue-140/implement-the-mongo-find-tool-with-unit-tests
feature/issue-139/implement-src-errors-ts-with-unit-tests-toolerror
feature/issue-138/implement-src-serialize-ts-with-unit-tests-ejson-t
feature/issue-136/implement-src-env-ts-with-unit-tests-mongodb-uri-r
feature/issue-135/register-the-mongodb-extension-in-the-repo-root-pa
feature/issue-133/initialize-the-extensions-mongodb-package-package
feature/issue-116/src-actions-ts-downloadrunlogs-zip-guarded-unzip-c
feature/issue-115/src-actions-ts-downloadjoblog-cache-first-attempt
feature/issue-114/src-actions-ts-metadata-queries-listactionruns-get
feature/issue-113/src-actionscache-ts-cache-paths-cache-first-read-w
feature/issue-112/add-zip-extraction-dependency-adm-zip-vs-yauzl
feature/issue-111/tracking-forgejo-actions-tooling-read-only-runs-jo
feature/issue-93/add-unit-tests-for-scripts-local-install-mjs-node
feature/issue-92/validate-install-local-end-to-end-on-the-dev-machi
feature/issue-90/implement-pi-registration-with-url-dedupe-and-relo
feature/issue-89/validate-install-local-from-a-scratch-clone-fresh
feature/issue-88/implement-git-pull-and-npm-install-steps-in-script
feature/issue-74/write-victorialogs-readme-md-and-reconcile-design
feature/issue-73/wire-up-index-ts-extension-factory-and-register-al
feature/issue-72/implement-logs-facets-tool-src-tools-facets-ts
feature/issue-71/implement-logs-hits-tool-src-tools-hits-ts
feature/issue-70/implement-logs-search-tool-src-tools-search-ts
feature/issue-69/implement-parsejsonlines-helper-in-src-client-ts
feature/issue-68/implement-victorialogsrequest-in-src-client-ts
feature/issue-67/implement-resolvebaseurl-in-src-env-ts
feature/issue-66/implement-totoolerror-in-src-errors-ts
feature/issue-65/implement-src-defaults-ts-shared-constants-and-app
feature/issue-64/scaffold-the-victorialogs-pi-extension-project
feature/issue-53/skip-issue-creation-for-chore-documentation-commit
feature/issue-45/fix-local-install-preflight-env-var-requirements-s
feature/issue-41/add-npm-run-local-install-script-to-update-and-ins
feature/issue-26/cross-reference-forgejo-list-milestones-from-issue
feature/issue-25/add-forgejo-milestone-delete-tool
feature/issue-24/add-forgejo-milestone-close-and-forgejo-milestone
feature/issue-23/add-forgejo-milestone-edit-tool
feature/issue-22/add-forgejo-milestone-view-tool
feature/issue-21/add-forgejo-list-milestones-tool
feature/issue-20/add-forgejo-milestone-create-tool
feature/issue-18/add-forgejo-label-create-tool
feature/issue-29/bug-forgejo-issue-create-view-edit-close-etc-crash
No results found.
Labels
Clear labels   
bug
Something isn't working

  
chore
Maintenance tasks, dependencies, and tooling

  
documentation
Improvements or additions to documentation

  
enhancement
New feature or request

  
feature
New functionality or capability

  
ready
No labels
bug
chore
documentation
enhancement
feature
ready
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
david/pi-extensions-and-skills#318
No description provided.