CedarCopilot wants to merge 15 commits into staging from feat/taxonomy-sql-surface
Live on prod, no production signal yet
Unable to complete verification because the targeted telemetry query timed out and no positive run-sql/taxonomy success signal was established.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Unable to complete the verification because the telemetry shows run-sql activity but no confirmed successful stage-query execution or decoded stage-label output. The available tied records include failures (`query-error`, `tenant-scope`, `self-join`, and `other`), while the.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Verification reached its 120s wall-clock budget before a tied verdict. Libra is keeping this intent verifying until the next check.
Libra has verdicts on 0 of 13 tracked behaviors on prod; 13 are still being checked. Libra has 1 low-confidence degraded verdict it is still confirming. Libra checks hourly for 3 days after each deploy.
Background taxonomy fields (objections, discovery questions, pain, demo moments, MEDDPICC signals, rep tactics) were queryable in principle and unreachable in practice. Three things were in the way, and the third was the important one:
<available_columns> is built from the user's AOP; Vooma's two deal-owning reps carry 0 taxonomy fields while the org carries 29.run-sql) returned rows inline capped at 500, while the unguarded path (Bash with the task's full credential set) could write files and iterate. The convenient path was the unsafe one, and no prompt guidance fixes an incentive gradient.Discovery. New taxonomy-fields MCP tool serving the org's field definitions from org_aops, including each field's extraction prompt, scoring rubrics, payload keys, and the stage vocabulary that decodes raw CRM stage values.
Stage. Atoms now take stage from crm_events.stage_at_time via source_event_id. stage_at_event_time is NULL on 100% of atoms (13,733/13,733 Vooma, 16,334/16,334 Aspire). groupBy:"stage" went from one null bucket to 9 and 12 real stages. Also fixed compute-metric silently ignoring filter.kinds, which made an instance-only filter count 44 versioned fields as taxonomy atoms.
Guard. Two rejections that blocked legitimate work, fixed without loosening the boundary:
crm_events joined upward via source_event_id (the canonical taxonomy join) is now accepted, as a pair-aware identity key valid only when the counterpart sits on a direct-org table. The existing cross-org leak test still fails the attack it was written for.CROSS JOIN LATERAL jsonb_array_elements(...) is no longer read as a tautological cross join. Versioned-field history lives in a jsonb array, so the entire judgment plane was unreachable from SQL.Credential isolation. Both agent spawn surfaces inherited all 57 secrets from runtime-contract.ts into a bypassPermissions Bash, including DATABASE_URL, ORG_CREDENTIALS_ENCRYPTION_KEY and BETTER_AUTH_SECRET. buildAgentEnv allowlists instead, and a CI test asserts no ALL_SECRET_FIELDS key survives, so a newly provisioned secret fails CI rather than leaking. The harness also gets a per-thread workspace as cwd instead of the service's source directory.
Native loop. cedar-sql on the agent's PATH: query, write a file, read it with jq or python, iterate. No row cap on file output. The shim carries a loopback URL and a session token, never a connection string, because the shim is a file the agent can read (the first draft embedded the connection string and cat defeated it). One executor with three sinks so run-sql, cedar-sql and external callers cannot drift on the tenant boundary. run-sql gains out for external callers: full result to a presigned URL they curl to their own disk.
Observability. Guarded SQL results report the org they ran against, because staff impersonation is keyed by caller alone and two concurrent sessions silently overwrite each other's target. Plus Bash reach telemetry (command, path prefixes, hostnames; never the command line or its output) so the sandbox's eventual denies are evidence-led.
Everything below was run against live Vooma and Aspire data and cross-checked against the database directly.
| Check | Result |
|---|---|
| Full server suite | 11,476 passed, 0 failed |
tsc -b | clean |
pnpm deps:check | no violations (1,750 modules) |
| eslint (changed files) | clean |
| Guard probe, 13 realistic taxonomy queries | 10 pass, 3 rejected by design with working rewrites (was 6/13) |
End to end through cedar-sql + jq, reproducing numbers verified independently in SQL:
Libra has not measured any production surfaces for this change yet.