# T47 SQLite Probe Adapter Validation

> - Task: T47 — Implement SQLite Probe adapter - Requirements: VES-DBP-002…005 - Commit target: feat(probe): add sqlite adapter - Focused evidence: 50 cases (10 contract, 9 integration, 31 security) - Spec deviations: no functional deviation; node:sqlite exposes no progress-handler API, so hard interruption remains owned by the qualified T41 isolated-worker termination path

Source: https://github.com/accd/verchestra/blob/main/docs/qualification/t47-validation.md
Content digest: `sha256:43beb801ff7c1adedb1ee187fa0fc0dcaecc43ecaabd8b4e5510a05c54d8adf7`

## Scope

- Task: T47 — Implement SQLite Probe adapter
- Requirements: VES-DBP-002…005
- Commit target: `feat(probe): add sqlite adapter`
- Focused evidence: 50 cases (10 contract, 9 integration, 31 security)
- Spec deviations: no functional deviation; `node:sqlite` exposes no progress-handler API, so hard interruption remains owned by the qualified T41 isolated-worker termination path

T47 adds a real `node:sqlite` read adapter with anonymous binds, exact SQLite identity evidence, read-only file open, defensive and query-only controls, extension denial, a closed authorizer, single-main-database enforcement, cancellation, safe `sqlite_schema` introspection, and byte-for-byte file preservation evidence.

## Deterministic gates

| Command | Result |
| --- | --- |
| `node --test tests/contract/sqlite-probe-adapter.test.mjs tests/integration/sqlite-probe-adapter.test.mjs tests/security/sqlite-probe-adapter.test.mjs` | PASS — 50 passed, 0 failed/skipped |
| `node scripts/gate.mjs security` | PASS — format, lint, typecheck/build, 1,496 unit/property, 10 architecture, 248 qualification, 483 security, and 55 fault cases |

## Adequacy matrix

| Criterion | Exact assertion evidence | Result |
| --- | --- | --- |
| SELECT/CTE and secrecy | `tests/contract/sqlite-probe-adapter.test.mjs:11-20` — exact objects/functions and absent SQL/value assertions | PASS |
| Safe catalog introspection | `tests/contract/sqlite-probe-adapter.test.mjs:22-24` and `tests/integration/sqlite-probe-adapter.test.mjs:22-31` — closed `main.sqlite_schema` path with unchanged bytes | PASS |
| Read-only open plus independent session controls (VES-DBP-002) | `tests/contract/sqlite-probe-adapter.test.mjs:32-43` — exact identity/query-only/authorizer evidence; `tests/integration/sqlite-probe-adapter.test.mjs:33-38` — real file evidence | PASS |
| Byte/digest preservation | `tests/integration/sqlite-probe-adapter.test.mjs:5-31` — real SELECT, CTE, and catalog reads preserve exact bytes and SHA-256 | PASS |
| ATTACH/PRAGMA/extensions/functions/write/parser denial | `tests/security/sqlite-probe-adapter.test.mjs:12-42` — stable-code assertion over 28 named SQL paths | PASS |
| Defense in depth at the real driver | `tests/security/sqlite-probe-adapter.test.mjs:50-62` — authorizer/read-only write denial and permanently disabled extension loading preserve bytes | PASS |
| Timeout and limits (VES-DBP-003) | `tests/integration/sqlite-probe-adapter.test.mjs:50-75` — exact timeout/row/byte errors and zero commits/one rollback | PASS |
| Protected plan/values (VES-DBP-003/004) | `tests/contract/sqlite-probe-adapter.test.mjs:50-78` — plan mismatch and bind mismatch occur before execution | PASS |
| Contradictory schema sources (VES-DBP-005) | Owned by T49 Database Knowledge Package; T47 supplies bounded catalog evidence without resolving contradictions | N/A locally |

## Necessary-test reverse map

| Test group | Requirement / done-when mapping | Keep |
| --- | --- | --- |
| Contract normalization, identity, session, stream | VES-DBP-002/004; SELECT/CTE/catalog/read-only criteria | Yes |
| Integration real-file digest, identity, timeout, row, byte | VES-DBP-002…004; immutable-open/file-preservation/limits criteria | Yes |
| Security SQL denial table | VES-DBP-003; ATTACH/PRAGMA/write/function/parser criteria | Yes |
| Security real driver denials | VES-DBP-002/003; authorizer and extension defense-in-depth criteria | Yes |

Adequacy verdict: necessary and sufficient for T47; every done-when criterion has exact assertion evidence and the focused count exceeds 26.

## Non-shallow checks

- The production-path fixture opens an actual SQLite file through `DatabaseSync` with `readOnly: true`, `allowExtension: false`, and `defensive: true`.
- `PRAGMA query_only=ON` is verified before installing an authorizer that permits only approved SELECT, READ, and function actions.
- Only the `main` database is accepted; ATTACH, DETACH, temporary objects, extra attached-database evidence, all user PRAGMAs, and recursive queries fail closed.
- Inline literals, quoted identifiers, numbered/named parameters, unsafe functions, writes, transaction controls, batches, comments, and unapproved catalogs fail before driver execution.
- Extension loading cannot be re-enabled on the connection because it was disabled at construction.
- Node 24.14.0 does not expose SQLite's native progress handler. Cooperative cancellation occurs between returned rows, while bounded timeout and hard cancellation are enforced by the already-qualified T41 isolated-worker supervisor and process-tree termination. A future runtime API must be separately qualified before replacing that boundary.
- Live application databases are not required for SQLite because the integration suite exercises real local files with the exact qualified runtime; platform release qualification remains mandatory.

## Verdict

PASS for T47 portable and real-file conformance. SQLite independently exceeds its test floor, preserves database bytes/digests, and the full security gate passes.