[5/6] feat: infer v3 encrypt config and convert the integration suite by freshtonic · Pull Request #427 · cipherstash/proxy

freshtonic · 2026-07-22T13:15:30Z

📚 eql-v3 PR · 5 of 6

Part of a queue. The PRs merge in FIFO order — the numbered order below, #1 first. Merging one supersedes the PRs after it until the author runs git queue sync (rebases the rest onto the merged base) and git queue submit (retargets their PRs).

✅🟢 #423 queue/eql-v3/upgrade-deps → main
♻️🟢 #424 queue/eql-v3/typecheck → queue/eql-v3/upgrade-deps
✅🟢 #428 queue/eql-v3/transform → queue/eql-v3/typecheck
✅🟢 #426 queue/eql-v3/showcase → queue/eql-v3/transform
⏳🟢 #427 queue/eql-v3/integration → queue/eql-v3/showcase 👈 this PR
⏳🟢 #430 feat/eql-v3-jsonb-composite-selectors → queue/eql-v3/integration

_{✅ approved · ♻️ changes requested · ⏳ review pending | 🟣 merged · 🟢 open · ⚫ closed — status as of the last git queue submit.}
_{🥞 Managed by git-queue — do not edit this list by hand.}

About this queue

Migrates CipherStash Proxy from EQL v2 to EQL v3 (cipherstash-client 0.34.1-alpha.4 → 0.42.0, EQL 2.3.0-pre.3 → 3.0.2), replacing the opaque eql_v2_encrypted composite type with 53 typed jsonb domains that encode both scalar type and searchable capability in the column type itself.

About this branch

Convert integration tests to EQL v3

coderabbitai · 2026-07-22T13:15:38Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c39a42de-a61e-4913-81e1-3caac1be971e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch queue/eql-v3/integration

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

The proxy's encrypt config is now derived from the database schema instead of the `eql_v2_configuration` table. EQL v3 columns are self-configuring domain types, so `eql_v2.add_search_config` and the config table are redundant — the schema is the single source of truth. - New encrypt_config/from_domain.rs: `column_config_from_domain` builds a ColumnConfig from a column's v3 domain typname — cast type from the token, indexes from the stored SEM terms (verified against cipherstash-client's indexers + eql-bindings v3::terms): hm→Unique, op→Ope, ob→Ore, bf→Match, JSON SteVec→SteVec{Compat}. Scalar non-text `_ord` domains store only `op` (a single Ope index, no HMAC); text carries `hm` alongside its ordering term. Storage-only and non-EQL domains yield no indexes / None. - load_encrypt_config now runs the shared SCHEMA_QUERY (which already returns information_schema.domain_name) and maps each encrypted column via column_config_from_domain. Removes the eql_v2_configuration query, the canonical-JSON path, ENCRYPT_CONFIG_QUERY + select_config.sql, and the MissingEncryptConfigTable startup handling (a load error is now a genuine database failure; an empty encrypted schema is a successful empty config). - The obsolete canonical-config parsing tests are dropped; from_domain.rs carries the equivalent domain→config coverage (9 tests). This unblocks running against a v3-only EQL install (which has no eql_v2_configuration). proxy builds; from_domain 9 tests pass; workspace check, clippy, fmt clean (pre-existing data_row::to_ciphertext_* failures are unrelated). Refs CIP-3595, CIP-3579. Stable-Commit-Id: q-6xh7ejw90r1kxzdd0jmmmkzd79

Replaces the EQL v2 `eql_v2_encrypted` columns + `add_search_config` / `add_encrypted_constraint` / `eql_v2_configuration` truncate with self-configuring v3 domain types (the proxy now infers encrypt config from the schema). - Main `encrypted` / `encrypted_elixir`: scalars use the default CLLW-OPE ordering domain `_ord` (op; also supports equality); `encrypted_text` is `text_search` (eq+ord+match); jsonb -> `json_search`. - `encrypted_bool` is `eql_v3_boolean` (storage-only) — boolean has no searchable capability in v3; the bool search fixtures/columns are dropped. - ORE/OPE fixture tables select their ordering family by `kind`: `ore` -> block-ORE (`_ord_ore`, `text_search_ore`), `ope` -> CLLW-OPE (`_ord_ope`, `text_ord_ope`). The `encrypted_bool` column and the `*_where_bool` fixtures are removed. - `unconfigured` columns become storage-only `eql_v3_text`. - schema-uninstall drops the tables; there is no v2 config table to remove. Refs CIP-3595. Stable-Commit-Id: q-5mf9na2j8evysprjfqpn7a8587

Follows the v3 schema conversion. The test crate now compiles and is consistent with EQL v3 semantics (runtime validation still needs a live Proxy + database with EQL v3 installed). - disable_mapping: the EqlEncrypted struct maps to `eql_v3_text_search` (the encrypted_text column's v3 domain) instead of `eql_v2_encrypted`. - jsonb_containment_index: the explicit `eql_v2.jsonb_contains(...)` call and comments become `eql_v3.jsonb_contains(...)`. - indexing: the encrypted index is now the v3 functional form `CREATE INDEX ON encrypted (eql_v3.ord_term(encrypted_text))`. - Bool search tests dropped (v3 boolean is storage-only): map_unique_index_bool, map_ore_where_generic_bool, map_ope_where_generic_bool. Bool roundtrip tests (encrypt/decrypt of a storage-only bool) are kept. - eql_regression (v2->v3 backwards-compat, which is out of scope — prior releases are not in use) is #[ignore]d with a note; regenerate fixtures from a v3 baseline to re-enable. Compiles clean; fmt clean. Refs CIP-3595. Stable-Commit-Id: q-17gkjm4bew1pevb1j47f7z0jvb

Convert the last docs, comments, and example SQL that still described the EQL v2 model (opaque `eql_v2_encrypted` type + `eql_v2.add_search_config` + `eql_v2_configuration` table) to the v3 self-configuring domain-type model. - ARCHITECTURE.md: rewrite the transformation-rules table (v3 rule set incl. RewriteEqlComparisonOps / RewriteEqlMatchOps) and the schema-loading paragraph (config inferred from domain types, no config table). - CONTEXT-MAP.md: update context/glossary entries; rewrite the "capability across the seam" note — the v3 schema loader now derives real per-column traits from the domain type, so the old "currently broken" bug is resolved. - docs/how-to/index.md: teach the `eql_v3_<token>_<cap>` domain-type model in place of add_search_config index setup; eql_v3.version(). - docs/reference/index.md: domain type enforces the encrypted-payload constraint; no add_encrypted_constraint call. - docs/reference/searchable-json.md: eql_v3_json_search schema + self-config note; caveat the v2 add_search_config option examples. - docs/errors.md, docs/sql/schema-example.sql, benchmark-schema.sql, parse.rs, psql-passthrough.sh, CLAUDE.md: v3 domain-type phrasing. Intentional v2 mentions retained: contrastive prose, the legacy-warn arm in schema/manager.rs, and the #[ignore]'d backwards-compat regression tests. Stable-Commit-Id: q-76caz2g4z3fptnpp8dn70s8v6g

…ALL) `eql_v3_json_search` columns were configured with `ArrayIndexMode::NONE`, which stores an array as a single opaque entry and never indexes its elements — so `@>`/`<@` containment against an array, `jsonb_array_elements`, and `[@]`/`[*]` path queries over encrypted arrays all failed (array element selectors did not exist to match). Index JSON arrays with `ArrayIndexMode::ALL` (item `[@]`, position `[n]`, and wildcard `[*]` element entries) so encrypted arrays are searchable the same way scalars are. This is the storage/searchability tradeoff a searchable JSON column opts into; the mode is a per-column config knob if a lighter footprint is wanted. Fixes 8 array integration tests: `jsonb_contains`/`jsonb_contained_by` with array needles (numeric + string), `jsonb_array_elements`, and `jsonb_path_query_first` array-wildcard (numeric + string). No regressions (jsonb suite 62->70 passing). `jsonb_array_length` over `[@]` remains open — it needs the flattened array-element rows counted, which is a separate rewrite. Stable-Commit-Id: q-3hn5yd17zqm6v6k7xex60x4wwa

blacksmith-sh · 2026-07-28T05:21:31Z

Blacksmith runners detected OOM events on the following jobs:

Job	Details
`Test (PostgreSQL 16)`	View Job

freshtonic force-pushed the queue/eql-v3/integration branch from bfd1787 to 2468552 Compare July 22, 2026 21:41

freshtonic requested review from coderdan and tobyhede and removed request for tobyhede July 22, 2026 21:42

freshtonic force-pushed the queue/eql-v3/showcase branch from bd7fd66 to 44ae965 Compare July 22, 2026 21:46

freshtonic force-pushed the queue/eql-v3/integration branch from 2468552 to 15c6096 Compare July 22, 2026 21:46

freshtonic force-pushed the queue/eql-v3/showcase branch from 44ae965 to b76f2bf Compare July 22, 2026 21:50

freshtonic force-pushed the queue/eql-v3/integration branch 2 times, most recently from b230984 to 029d94f Compare July 22, 2026 22:20

freshtonic mentioned this pull request Jul 22, 2026

[3/6] feat(eql-mapper): rewrite SQL to the EQL v3 functional-index form #428

Closed

freshtonic changed the title ~~[5/5] test(integration): make the integration tests v3-shaped~~ [6/6] test(integration): make the integration tests v3-shaped Jul 22, 2026

freshtonic removed the request for review from coderdan July 22, 2026 23:40

freshtonic force-pushed the queue/eql-v3/showcase branch from b76f2bf to 4daab58 Compare July 23, 2026 06:08

freshtonic force-pushed the queue/eql-v3/integration branch from 029d94f to 3bb2179 Compare July 23, 2026 06:08

freshtonic force-pushed the queue/eql-v3/showcase branch from 4daab58 to ef7d140 Compare July 23, 2026 11:42

freshtonic force-pushed the queue/eql-v3/integration branch from 3bb2179 to 6e5f923 Compare July 23, 2026 11:42

freshtonic changed the title ~~[6/6] test(integration): make the integration tests v3-shaped~~ [6/6] feat: infer v3 encrypt config and convert the integration suite Jul 23, 2026

freshtonic force-pushed the queue/eql-v3/showcase branch from ef7d140 to 1191ee8 Compare July 23, 2026 12:12

freshtonic force-pushed the queue/eql-v3/integration branch from 6e5f923 to c5ef84d Compare July 23, 2026 12:12

freshtonic force-pushed the queue/eql-v3/showcase branch from 1191ee8 to 191a240 Compare July 24, 2026 00:59

freshtonic force-pushed the queue/eql-v3/integration branch from c5ef84d to 609834d Compare July 24, 2026 00:59

freshtonic force-pushed the queue/eql-v3/showcase branch from 191a240 to 6264fba Compare July 24, 2026 01:42

freshtonic force-pushed the queue/eql-v3/integration branch from 609834d to 39c17c9 Compare July 24, 2026 01:42

freshtonic force-pushed the queue/eql-v3/showcase branch from 6264fba to 1672c1d Compare July 24, 2026 03:35

freshtonic force-pushed the queue/eql-v3/integration branch from 39c17c9 to 585ce2b Compare July 24, 2026 03:35

freshtonic force-pushed the queue/eql-v3/showcase branch from 1672c1d to 81e4096 Compare July 24, 2026 03:50

freshtonic force-pushed the queue/eql-v3/integration branch from 585ce2b to 69cda0b Compare July 24, 2026 03:50

freshtonic force-pushed the queue/eql-v3/showcase branch from 81e4096 to f6c40eb Compare July 24, 2026 12:54

freshtonic force-pushed the queue/eql-v3/integration branch from 69cda0b to 0dd8cc1 Compare July 24, 2026 12:54

freshtonic force-pushed the queue/eql-v3/showcase branch from f6c40eb to d7a048d Compare July 24, 2026 13:47

freshtonic force-pushed the queue/eql-v3/integration branch from 0dd8cc1 to d14efc8 Compare July 24, 2026 13:47

freshtonic force-pushed the queue/eql-v3/showcase branch from d7a048d to 8ab77ef Compare July 25, 2026 07:41

freshtonic force-pushed the queue/eql-v3/integration branch from d14efc8 to 7368e95 Compare July 25, 2026 07:41

freshtonic changed the title ~~[6/6] feat: infer v3 encrypt config and convert the integration suite~~ [6/7] feat: infer v3 encrypt config and convert the integration suite Jul 27, 2026

freshtonic mentioned this pull request Jul 27, 2026

[6/6] chore(deps): upgrade EQL and eql-bindings to 3.0.3 #430

Closed

freshtonic force-pushed the queue/eql-v3/showcase branch from 8ab77ef to 7184084 Compare July 27, 2026 14:11

freshtonic force-pushed the queue/eql-v3/integration branch from 9d67d39 to 280a0a3 Compare July 27, 2026 14:11

freshtonic added 5 commits July 28, 2026 14:58

freshtonic force-pushed the queue/eql-v3/showcase branch from 7184084 to 6775e22 Compare July 28, 2026 04:58

freshtonic force-pushed the queue/eql-v3/integration branch from 280a0a3 to 68f56d3 Compare July 28, 2026 04:59

freshtonic changed the title ~~[6/7] feat: infer v3 encrypt config and convert the integration suite~~ [5/6] feat: infer v3 encrypt config and convert the integration suite Jul 28, 2026

freshtonic closed this Jul 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[5/6] feat: infer v3 encrypt config and convert the integration suite - #427

[5/6] feat: infer v3 encrypt config and convert the integration suite#427
freshtonic wants to merge 5 commits into
queue/eql-v3/showcasefrom
queue/eql-v3/integration

freshtonic commented Jul 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Review skipped

Uh oh!

blacksmith-sh Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

freshtonic commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📚 eql-v3 PR · 5 of 6

About this queue

About this branch

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

blacksmith-sh Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

freshtonic commented Jul 22, 2026 •

edited

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading