fix(knowledge): stop document ACL changes from rewriting unfilled projection chunks

[waleedlatif1]

Summary

• sync_projection_source_acl() updated every enabled chunk whose projected ACL differed from the document's; a chunk the projection backfill hasn't filled (acl IS NULL) always differs, so any real document ACL change rewrote all its unfilled chunks (each a vector index insert) inside the writer's statement — admin ACL writes, the permissions-only revoke, and rewriteConnectorAcls all paid it
• New trigger body: unfilled chunks keep acl = NULL; filled chunks still get the new ACL and source; unfilled chunks get the new source only when the document actually moves (OLD.connector_id IS DISTINCT FROM NEW.connector_id), since source filters read connector_id off the row
• Ships as script migration 0023_projection_acl_skip_unfilled (runs in the migrate job after SQL migrations), which only CREATE OR REPLACEs the function; 0022/db:push install the same body via the shared replaceProjectionSourceAclSync
• Adds a CI step for the projection trigger/backfill Postgres test, which was not run in CI before

Why it's safe

• Search decides a NULL-acl projection row on its document (projectionCandidateAccessCondition unfilled branch), so leaving it NULL can't leak or hide anything; the "projection filled" probe only ever sees fewer NULLs, never new ones
• Backfill pages read connector_id/acl from the document FOR SHARE and only write rows still NULL. Change committed first → the page reads the new values. Page holds the share lock first → the change waits, then its trigger sees a filled row and overwrites it. Change uncommitted when the page arrives → the page waits and rechecks the updated document. All three are covered by tests with real lock waits
• The projection BEFORE INSERT/UPDATE OF document_id, enabled trigger is unchanged, so new and re-enabled chunks are still filled from their document

Type of Change

• Bug fix

Testing

• Postgres tests: changed ACL updates filled chunks and skips unfilled ones; a moved document still carries its source onto unfilled chunks; 0023 replaces the previous body in place; three backfill/ACL-change interleavings end with the current ACL
• Mutation-checked: old body → 3 red; skipping unfilled rows entirely → 1 red (source move); writing the ACL onto unfilled rows on a move → 1 red; syncing source onto unfilled rows without a move → 1 red; 0023 as a no-op → 1 red
• bun run lint, bun run check:audits, type-check (packages/db, apps/sim), check:migrations origin/staging pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 22, 2026 10:47pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the prior CI prerequisite issue is resolved and no new actionable defects remain.

Summary

This PR changes the projection ACL synchronization function so document ACL updates avoid rewriting projection chunks whose ACL backfill has not completed, while connector moves still update their source metadata.

• Adds an ordered script migration that replaces the trigger function for existing databases.
• Keeps new installations and schema-push environments aligned through the shared function installer.
• Adds PostgreSQL coverage for filled and unfilled chunks, connector moves, migration replacement, and concurrent backfill/ACL-update interleavings.
• Adds the PostgreSQL integration test to CI with self-contained test-database setup.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  D[Document ACL or connector changes] --> T[sync_projection_source_acl trigger]
  T --> F{Projection ACL filled?}
  F -->|Yes| U[Update connector source and ACL]
  F -->|No| M{Connector moved?}
  M -->|Yes| S[Update connector source; preserve NULL ACL]
  M -->|No| N[Leave projection row untouched]
  S --> B[Backfill later copies current document ACL]
  N --> B

Loading

_{Reviews (2) · Last reviewed commit: "chore(ci): create the ACL test database ..."}

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}