[Thom Chiovoloni (thomcc-work)]

Fixes #139
WIP still. Will update description when it's further along.

[Copilot]

🟡 Changes recommended

A non-superuser can bypass both quotas through repeated transaction rollbacks because instance accounting is rolled back while enqueue commits separately, allowing unaccounted engine work and retained failure history.

1 open issue

• A non-superuser can repeatedly run BEGIN; SELECT df.start('SELECT 1'); ROLLBACK; to bypass both… · New

What changed in this PR

Adds per-role instance quotas to df.start() to address denial-of-service risks from excessive workflow submissions, with enforcement in both transaction modes.

Changes:

• Adds configurable active and retained-instance quotas, serialized admission checks, and quota error hints.
• Adds an owner-leading index and prepares version 0.2.10 with upgrade support.
• Adds quota, concurrency, isolation, and security tests, plus configuration and upgrade documentation.

File	Description
USER_GUIDE.md	Documents quota configuration, scope, retention, and transaction interactions.
tests/​e2e/​sql/​93_start_limits_serializable.sql	Tests overlapping serializable starts and transaction retries.
tests/​e2e/​sql/​92_start_limits_trust.sql	Tests protected accounting and resistance to status and lock manipulation.
tests/​e2e/​sql/​91_start_limits_concurrency.sql	Tests admission locking, isolation levels, rollback, and timeouts.
tests/​e2e/​sql/​90_start_limits.sql	Tests quota settings, enforcement, identities, and transaction modes.
tests/​e2e/​sql/​89_schema_qualification.sql	Adds aggregate-shadowing traps for quota queries.
tests/​e2e/​sql/​00_setup_playground.sql	Adds a helper to wait for engine-terminal state.
src/​lib.rs	Registers quota settings and the fresh-install index.
src/​dsl.rs	Enforces quotas with per-role locking and current-snapshot counts.
src/​client.rs	Counts engine-active instances and preserves quota error details.
sql/​pg_durable--0.2.9--0.2.10.sql	Adds the quota index during extension upgrade.
scripts/​test-upgrade.sh	Tests quota enforcement against older installed schemas.
docs/​upgrade-testing.md	Describes quota compatibility, migration, and performance considerations.
docs/​api-reference.md	Documents quota settings and start rejection behavior.
CHANGELOG.md	Records quota security changes and upgrade implications.
Cargo.toml	Bumps the package version to 0.2.10.
Cargo.lock	Aligns the locked package version with 0.2.10.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Submission records can be deleted despite failed local metadata cleanup, falsely blocking submissions through quota accounting, while reused rolled-back IDs can abort starts instead of triggering retries.

2 open issues

• Preserve submission accounting when metadata deletion fails · New
• Retry IDs reserved by rolled-back submissions · New

1 resolved since last review

• A non-superuser can repeatedly run BEGIN; SELECT df.start('SELECT 1'); ROLLBACK; to bypass both…

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive admission combines PostgreSQL locking and snapshots with independently committed provider state, requiring human review and unavailable runtime validation of concurrency, rollback, cleanup, and binary-only upgrades.

No open issues 🎉

2 resolved since last review

• Preserve submission accounting when metadata deletion fails
• Retry IDs reserved by rolled-back submissions

_{Review effort: Balanced}