Warden plan
tier: destructive requires: [needs-postgres]
This plan restores the batteries-included Warden Corpus fixture — 164 signals across 7 domains, 14 regenerated wikis, 5 inbox suggestions, 53 raw sources, all pipeline-embedded/classified — then asserts retrieval quality with zero model calls at eval time (D-03), graph/domain shape, citation integrity, and wiki_suggestions lifecycle facts against it. Per D-04, every assertion is manifest-driven or structural, never pinned to today's fingerprint or literal signal text.
greenlight-pg :5433 with the vector extension; jq + psql on PATH — restore-seed.sh already requires jq. The env file is provisioned automatically by .warden/run.sh from .warden/env/ci-env.template.sh + ~/.config/robin/warden-secrets.sh.robin_ci exactly like 05/12/13/14/15 — "disposable test infra, not shared state." After this plan runs, robin_ci holds the fixture, not any local demo, per SEQUENCE.md's "Seed fixture" section.set -uo pipefail
source "$WARDEN_LIB/assert.sh"
cd "${PROJECT_ROOT:-$(git rev-parse --show-toplevel)}"
# shellcheck disable=SC1091
source "${WARDEN_ENV_FILE:?WARDEN_ENV_FILE not set — run this plan via .warden/run.sh}"
MANIFEST="${WARDEN_SEED_MANIFEST:-$HOME/.config/robin/warden-seed.manifest.json}"
RESTORE_OUT="$(mktemp)"
trap 'rm -f "$RESTORE_OUT"' EXIT
bash "$WARDEN_DIR/scripts/restore-seed.sh" > "$RESTORE_OUT" 2>&1
RESTORE_STATUS=$?
if [ "$RESTORE_STATUS" -eq 0 ]; then
warden_pass "restore-seed.sh exits 0"
else
tail -20 "$RESTORE_OUT"
warden_fail "restore-seed.sh did not exit 0 (status=$RESTORE_STATUS) — see output above"
fi
RESTORED_FP=$(grep -oE '^WARDEN_SEED_FINGERPRINT=[0-9a-f]{16}$' "$RESTORE_OUT" | cut -d= -f2)
MANIFEST_FP=$(jq -r '.fingerprint' "$MANIFEST")
if [ -n "$RESTORED_FP" ] && [ "$RESTORED_FP" = "$MANIFEST_FP" ]; then
warden_pass "stdout carries WARDEN_SEED_FINGERPRINT=$RESTORED_FP, matching the manifest"
else
warden_fail "stdout fingerprint ($RESTORED_FP) missing or not equal to manifest fingerprint ($MANIFEST_FP)"
fi
RESTORED_SIGNALS=$(grep -oE '^WARDEN_SEED_SIGNALS=[0-9]+$' "$RESTORE_OUT" | cut -d= -f2)
EXPECTED_SIGNALS=$(jq -r '.counts.signals' "$MANIFEST")
if [ -n "$RESTORED_SIGNALS" ] && [ "$RESTORED_SIGNALS" = "$EXPECTED_SIGNALS" ]; then
warden_pass "stdout carries WARDEN_SEED_SIGNALS=$RESTORED_SIGNALS, matching manifest counts.signals"
else
warden_fail "stdout WARDEN_SEED_SIGNALS ($RESTORED_SIGNALS) does not match manifest counts.signals ($EXPECTED_SIGNALS)"
fi
ORG_SLUG=$(jq -r '.org_slug' "$MANIFEST")
# is_root + workspaces_root_uidx (a partial UNIQUE index on organization_id
# WHERE is_root) make ">1 root workspace per org" a schema-enforced
# impossibility, not just a convention — filtering on it here (rather than
# organization.slug alone, which does not bound workspace count) plus the
# row-count check below is the loud guard: a future multi-workspace fixture
# fails instead of silently taking whichever row psql happened to return.
WORKSPACE_ROWS=$(psql "$DATABASE_URL" -tAc "select w.id from workspaces w join organization o on o.id = w.organization_id where o.slug = '$ORG_SLUG' and w.is_root")
WORKSPACE_COUNT=$(printf '%s\n' "$WORKSPACE_ROWS" | grep -c .)
WORKSPACE_ID=$(printf '%s\n' "$WORKSPACE_ROWS" | head -1)
if [ "$WORKSPACE_COUNT" = "1" ]; then
warden_pass "resolved exactly one root workspace_id=$WORKSPACE_ID for organization.slug='$ORG_SLUG'"
else
warden_fail "expected exactly 1 root workspace for organization.slug='$ORG_SLUG', found $WORKSPACE_COUNT"
fi
MISMATCHES=""
for TBL_KEY in "signals:signals" "wikis:wikis" "knowledge_domains:knowledge_domains" "wiki_suggestions:wiki_suggestions" "raw_sources:raw_sources"; do
TBL="${TBL_KEY%%:*}"
KEY="${TBL_KEY##*:}"
EXPECTED=$(jq -r ".counts.$KEY" "$MANIFEST")
ACTUAL=$(psql "$DATABASE_URL" -tAc "select count(*) from $TBL where workspace_id = '$WORKSPACE_ID'")
[ "$EXPECTED" = "$ACTUAL" ] || MISMATCHES="$MISMATCHES $TBL(expected=$EXPECTED,actual=$ACTUAL)"
done
EXPECTED_USERS=$(jq -r '.counts.users' "$MANIFEST")
ACTUAL_USERS=$(psql "$DATABASE_URL" -tAc "select count(*) from users")
[ "$EXPECTED_USERS" = "$ACTUAL_USERS" ] || MISMATCHES="$MISMATCHES users(expected=$EXPECTED_USERS,actual=$ACTUAL_USERS)"
if [ -z "$MISMATCHES" ]; then
warden_pass "all 6 manifest counts match the restored DB (signals/wikis/knowledge_domains/wiki_suggestions/raw_sources/users)"
else
warden_fail "restored DB drifts from the manifest:$MISMATCHES"
fiset -uo pipefail
source "$WARDEN_LIB/assert.sh"
cd "${PROJECT_ROOT:-$(git rev-parse --show-toplevel)}"
# shellcheck disable=SC1091
source "${WARDEN_ENV_FILE:?WARDEN_ENV_FILE not set — run this plan via .warden/run.sh}"
MANIFEST="${WARDEN_SEED_MANIFEST:-$HOME/.config/robin/warden-seed.manifest.json}"
ORG_SLUG=$(jq -r '.org_slug' "$MANIFEST")
# Filtered on is_root — Step 1 already asserts exactly one root workspace
# resolves for this org_slug (schema-guaranteed by workspaces_root_uidx).
WORKSPACE_ID=$(psql "$DATABASE_URL" -tAc "select w.id from workspaces w join organization o on o.id = w.organization_id where o.slug = '$ORG_SLUG' and w.is_root")
SR_SIG_OUT="$(mktemp)"
trap 'rm -f "$SR_SIG_OUT"' EXIT
psql "$DATABASE_URL" -tAc "
WITH nn AS (
SELECT s.lookup_key AS query_key,
(SELECT s2.lookup_key FROM signals s2
WHERE s2.embedding IS NOT NULL AND s2.workspace_id = '$WORKSPACE_ID'
ORDER BY s2.embedding <=> s.embedding LIMIT 1) AS top1_key
FROM signals s WHERE s.embedding IS NOT NULL AND s.workspace_id = '$WORKSPACE_ID'
)
SELECT count(*) FILTER (WHERE query_key <> top1_key), count(*) FROM nn;" > "$SR_SIG_OUT"
SR_SIG_MISMATCH=$(cut -d'|' -f1 "$SR_SIG_OUT" | tr -d ' ')
SR_SIG_TOTAL=$(cut -d'|' -f2 "$SR_SIG_OUT" | tr -d ' ')
EXPECTED_SIGNALS=$(jq -r '.counts.signals' "$MANIFEST")
if [ "$SR_SIG_MISMATCH" = "0" ] && [ "$SR_SIG_TOTAL" = "$EXPECTED_SIGNALS" ]; then
warden_pass "signals self-retrieval top-1 holds for all $SR_SIG_TOTAL embedded signals, matching manifest counts.signals"
else
warden_fail "signals self-retrieval top-1 broken: $SR_SIG_MISMATCH mismatches of $SR_SIG_TOTAL rows (expected $EXPECTED_SIGNALS)"
fi
SR_WIKI_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
WITH nn AS (
SELECT w.lookup_key AS query_key,
(SELECT w2.lookup_key FROM wikis w2
WHERE w2.embedding IS NOT NULL AND w2.workspace_id = '$WORKSPACE_ID'
ORDER BY w2.embedding <=> w.embedding LIMIT 1) AS top1_key
FROM wikis w WHERE w.embedding IS NOT NULL AND w.workspace_id = '$WORKSPACE_ID'
)
SELECT count(*) FILTER (WHERE query_key <> top1_key), count(*) FROM nn;" > "$SR_WIKI_OUT"
SR_WIKI_MISMATCH=$(cut -d'|' -f1 "$SR_WIKI_OUT" | tr -d ' ')
SR_WIKI_TOTAL=$(cut -d'|' -f2 "$SR_WIKI_OUT" | tr -d ' ')
EXPECTED_WIKIS=$(jq -r '.counts.wikis' "$MANIFEST")
if [ "$SR_WIKI_MISMATCH" = "0" ] && [ "$SR_WIKI_TOTAL" = "$EXPECTED_WIKIS" ]; then
warden_pass "wikis self-retrieval top-1 holds for all $SR_WIKI_TOTAL embedded wikis, matching manifest counts.wikis"
else
warden_fail "wikis self-retrieval top-1 broken: $SR_WIKI_MISMATCH mismatches of $SR_WIKI_TOTAL rows (expected $EXPECTED_WIKIS)"
fi
STM_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
WITH sig_domains AS (
SELECT signal_id, array_agg(domain_id) AS domains FROM domain_signals GROUP BY signal_id
),
topk AS (
SELECT s.lookup_key AS query_key, s2.lookup_key AS nbr_key,
row_number() OVER (PARTITION BY s.lookup_key ORDER BY s.embedding <=> s2.embedding) AS rn
FROM signals s
JOIN signals s2 ON s2.lookup_key <> s.lookup_key AND s2.embedding IS NOT NULL AND s2.workspace_id = '$WORKSPACE_ID'
WHERE s.embedding IS NOT NULL AND s.workspace_id = '$WORKSPACE_ID'
),
topk5 AS (SELECT * FROM topk WHERE rn <= 5),
matches AS (
SELECT t.query_key, (qd.domains && nd.domains) AS same_domain
FROM topk5 t
JOIN sig_domains qd ON qd.signal_id = t.query_key
JOIN sig_domains nd ON nd.signal_id = t.nbr_key
),
per_query AS (
SELECT query_key, count(*) FILTER (WHERE same_domain) AS same_count, count(*) AS total
FROM matches GROUP BY query_key
)
SELECT count(*) FILTER (WHERE same_count::float/total >= 0.5), count(*) FROM per_query;" > "$STM_OUT"
STM_MAJORITY=$(cut -d'|' -f1 "$STM_OUT" | tr -d ' ')
STM_TOTAL=$(cut -d'|' -f2 "$STM_OUT" | tr -d ' ')
DISTINCT_CLASSIFIED=$(psql "$DATABASE_URL" -tAc "select count(distinct ds.signal_id) from domain_signals ds join signals s on s.lookup_key = ds.signal_id where s.workspace_id = '$WORKSPACE_ID';")
if [ "$STM_TOTAL" -gt 0 ] && [ "$STM_TOTAL" -le "$DISTINCT_CLASSIFIED" ] && [ "$(awk -v m="$STM_MAJORITY" -v t="$STM_TOTAL" 'BEGIN{print (m/t >= 0.8)}')" = "1" ]; then
warden_pass "same-topic majority holds for $STM_MAJORITY/$STM_TOTAL domain-classified signals (>=80% threshold, top-5 neighbors, of $DISTINCT_CLASSIFIED classified)"
else
warden_fail "same-topic majority held for only $STM_MAJORITY/$STM_TOTAL domain-classified signals (<80% threshold or scoping drift vs $DISTINCT_CLASSIFIED classified)"
fi
CT_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
WITH sig_dom AS (
SELECT ds.signal_id, ds.domain_id, s.embedding
FROM domain_signals ds JOIN signals s ON s.lookup_key = ds.signal_id AND s.workspace_id = '$WORKSPACE_ID'
WHERE s.embedding IS NOT NULL
),
pairs AS (
SELECT (a.domain_id = b.domain_id) AS same_domain, (a.embedding <=> b.embedding) AS dist
FROM sig_dom a JOIN sig_dom b ON a.signal_id < b.signal_id
)
SELECT same_domain, avg(dist) FROM pairs GROUP BY same_domain ORDER BY same_domain;" > "$CT_OUT"
WITHIN_AVG=$(grep '^t|' "$CT_OUT" | cut -d'|' -f2 | tr -d ' ')
CROSS_AVG=$(grep '^f|' "$CT_OUT" | cut -d'|' -f2 | tr -d ' ')
if [ -n "$WITHIN_AVG" ] && [ -n "$CROSS_AVG" ] && [ "$(awk -v w="$WITHIN_AVG" -v c="$CROSS_AVG" 'BEGIN{print (w < c)}')" = "1" ]; then
warden_pass "cross-topic sanity holds: within-domain avg cosine distance ($WITHIN_AVG) < cross-domain avg ($CROSS_AVG)"
else
cat "$CT_OUT"
warden_fail "cross-topic sanity failed: within-domain avg distance is not below cross-domain avg — see output above"
fiset -uo pipefail
source "$WARDEN_LIB/assert.sh"
cd "${PROJECT_ROOT:-$(git rev-parse --show-toplevel)}"
# shellcheck disable=SC1091
source "${WARDEN_ENV_FILE:?WARDEN_ENV_FILE not set — run this plan via .warden/run.sh}"
MANIFEST="${WARDEN_SEED_MANIFEST:-$HOME/.config/robin/warden-seed.manifest.json}"
ORG_SLUG=$(jq -r '.org_slug' "$MANIFEST")
# Filtered on is_root — Step 1 already asserts exactly one root workspace
# resolves for this org_slug (schema-guaranteed by workspaces_root_uidx).
WORKSPACE_ID=$(psql "$DATABASE_URL" -tAc "select w.id from workspaces w join organization o on o.id = w.organization_id where o.slug = '$ORG_SLUG' and w.is_root")
EMPTY_DOMAINS=$(psql "$DATABASE_URL" -tAc "select count(*) from knowledge_domains kd where kd.workspace_id = '$WORKSPACE_ID' and not exists (select 1 from domain_signals ds where ds.domain_id = kd.id);")
ORPHAN_WIKI_DOMAINS=$(psql "$DATABASE_URL" -tAc "select count(*) from wikis w where w.workspace_id = '$WORKSPACE_ID' and not exists (select 1 from wiki_domains wd where wd.wiki_id = w.lookup_key);")
if [ "$EMPTY_DOMAINS" = "0" ] && [ "$ORPHAN_WIKI_DOMAINS" = "0" ]; then
warden_pass "graph/domain shape holds: 0 empty knowledge_domains, 0 wikis without a domain attachment"
else
warden_fail "graph/domain shape broken: $EMPTY_DOMAINS empty domains, $ORPHAN_WIKI_DOMAINS wikis without a domain"
fi
CIT_OUT="$(mktemp)"
trap 'rm -f "$CIT_OUT"' EXIT
psql "$DATABASE_URL" -tAc "
WITH decl AS (
SELECT jsonb_array_elements(w.citation_declarations) AS d
FROM wikis w WHERE w.workspace_id = '$WORKSPACE_ID'
),
sigids AS (SELECT jsonb_array_elements_text(d->'signalIds') AS signal_id FROM decl)
SELECT count(*), count(*) FILTER (WHERE s.lookup_key IS NULL) FROM sigids LEFT JOIN signals s ON s.lookup_key = sigids.signal_id;" > "$CIT_OUT"
CIT_TOTAL=$(cut -d'|' -f1 "$CIT_OUT" | tr -d ' ')
CIT_MISSING=$(cut -d'|' -f2 "$CIT_OUT" | tr -d ' ')
ANCHOR_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
WITH decl AS (
SELECT w.lookup_key AS wiki_key, (jsonb_array_elements(w.citation_declarations)->>'sectionAnchor') AS anchor
FROM wikis w WHERE w.workspace_id = '$WORKSPACE_ID'
),
headings AS (
SELECT w.lookup_key AS wiki_key,
lower(regexp_replace(regexp_replace(trim(both from (regexp_matches(line, '^#{1,6}\s+(.+?)\s*\$'))[1]), '[^a-zA-Z0-9]+', '-', 'g'), '^-+|-+\$', '', 'g')) AS heading_slug
FROM wikis w, unnest(string_to_array(w.content, E'\n')) AS line
WHERE w.workspace_id = '$WORKSPACE_ID' AND line ~ '^#{1,6}\s+.+'
)
SELECT count(*), count(*) FILTER (WHERE NOT EXISTS (
SELECT 1 FROM headings h WHERE h.wiki_key = decl.wiki_key
AND (h.heading_slug = decl.anchor OR h.heading_slug = regexp_replace(decl.anchor, '-[0-9]+\$', ''))
)) FROM decl;" > "$ANCHOR_OUT"
ANCHOR_TOTAL=$(cut -d'|' -f1 "$ANCHOR_OUT" | tr -d ' ')
ANCHOR_UNRESOLVED=$(cut -d'|' -f2 "$ANCHOR_OUT" | tr -d ' ')
if [ "$CIT_TOTAL" -gt 0 ] && [ "$CIT_MISSING" = "0" ] && [ "$ANCHOR_TOTAL" -gt 0 ] && [ "$ANCHOR_UNRESOLVED" = "0" ]; then
warden_pass "citation integrity holds: $CIT_TOTAL cited signalIds all resolve, $ANCHOR_TOTAL sectionAnchors all resolve to a real heading"
else
warden_fail "citation integrity broken: $CIT_MISSING/$CIT_TOTAL signalIds missing, $ANCHOR_UNRESOLVED/$ANCHOR_TOTAL anchors unresolved"
fi
EDGE_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
select count(*), count(*) filter (
where not exists (select 1 from signals s where s.lookup_key = e.src_id)
or not exists (select 1 from wikis w where w.lookup_key = e.dst_id)
)
from edges e
where e.edge_type = 'SIGNAL_CITED_BY_WIKI' and e.src_type = 'signal' and e.dst_type = 'wiki'
and e.workspace_id = '$WORKSPACE_ID';" > "$EDGE_OUT"
EDGE_TOTAL=$(cut -d'|' -f1 "$EDGE_OUT" | tr -d ' ')
EDGE_ORPHANS=$(cut -d'|' -f2 "$EDGE_OUT" | tr -d ' ')
if [ "$EDGE_TOTAL" -gt 0 ] && [ "$EDGE_ORPHANS" = "0" ]; then
warden_pass "SIGNAL_CITED_BY_WIKI edge graph holds: $EDGE_TOTAL edges, 0 dangling src/dst references"
else
warden_fail "SIGNAL_CITED_BY_WIKI edge graph broken: $EDGE_ORPHANS/$EDGE_TOTAL edges reference a missing signal or wiki"
fi
ORPHAN_TARGETS=$(psql "$DATABASE_URL" -tAc "select count(*) from wiki_suggestions ws where ws.workspace_id = '$WORKSPACE_ID' and not exists (select 1 from wikis w where w.lookup_key = ws.wiki_id);")
BAD_STATUS=$(psql "$DATABASE_URL" -tAc "select count(*) from wiki_suggestions ws where ws.workspace_id = '$WORKSPACE_ID' and ws.status not in ('pending','accepted','rejected','revised');")
SUGG_CIT_OUT="$(mktemp)"
psql "$DATABASE_URL" -tAc "
WITH cit AS (
SELECT jsonb_array_elements(ws.citations)->>'signalId' AS sid FROM wiki_suggestions ws
WHERE ws.workspace_id = '$WORKSPACE_ID' AND jsonb_array_length(ws.citations) > 0
)
SELECT count(*), count(*) FILTER (WHERE s.lookup_key IS NULL) FROM cit LEFT JOIN signals s ON s.lookup_key = cit.sid;" > "$SUGG_CIT_OUT"
SUGG_CIT_TOTAL=$(cut -d'|' -f1 "$SUGG_CIT_OUT" | tr -d ' ')
SUGG_CIT_MISSING=$(cut -d'|' -f2 "$SUGG_CIT_OUT" | tr -d ' ')
EXPECTED_SUGGESTIONS=$(jq -r '.counts.wiki_suggestions' "$MANIFEST")
ACTUAL_SUGGESTIONS=$(psql "$DATABASE_URL" -tAc "select count(*) from wiki_suggestions where workspace_id = '$WORKSPACE_ID';")
if [ "$ORPHAN_TARGETS" = "0" ] && [ "$BAD_STATUS" = "0" ] && [ "$SUGG_CIT_TOTAL" -gt 0 ] && [ "$SUGG_CIT_MISSING" = "0" ] && [ "$ACTUAL_SUGGESTIONS" = "$EXPECTED_SUGGESTIONS" ]; then
warden_pass "wiki_suggestions lifecycle facts hold: $ACTUAL_SUGGESTIONS rows, 0 orphan targets, 0 unknown statuses, $SUGG_CIT_TOTAL cited signalIds all resolve"
else
warden_fail "wiki_suggestions lifecycle broken: $ACTUAL_SUGGESTIONS/$EXPECTED_SUGGESTIONS rows, $ORPHAN_TARGETS orphan targets, $BAD_STATUS unknown statuses, $SUGG_CIT_MISSING/$SUGG_CIT_TOTAL citations unresolved"
fi