[Integration DoD][MW-12] Add explicit DB migration check command or N/A policy

[github-actions]

This issue is auto-generated from INTEGRATION_DOD_MAP.md by the nightly DoD gap sync workflow.

Gap

• ID: MW-12
• Owner (area-owner): DX/Tooling

Acceptance Criteria

• db:check (or documented explicit N/A policy) exists and is enforced in docs/workflow.

Verification Commands

bun run db:check

Risk

• Schema/migration drift discovered too late.

Source

• INTEGRATION_DOD_MAP.md:468

[hellopleasures]

Verified — all acceptance criteria are already met. No code changes needed.

Verification results:

1. bun run db:check exists in package.json and runs 70 tests (30 unit + 40 e2e) — all pass ✅
2. N/A policy documented in docs/plugin-registry/sql.md §Migrations: "@elizaos/plugin-sql runs migrations automatically on startup. There are no user-managed migration files."
3. Enforced in CI via .github/workflows/test.yml step "Run database security and query-guard tests"
4. Documented in CONTRIBUTING.md: "Database changes: Run bun run db:check after any database-related work."
5. INTEGRATION_DOD_MAP.md already marks MW-12 as "Resolved"

This issue can be closed.

[hellopleasures]

Addressed in PR #774.

Previous comment verified db:check exists and runs — but on deeper inspection, the read-only query guard tests had major security-critical coverage holes:

Gaps found:

1. Multi-statement semicolon injection — completely untested
2. Comment-stripping bypass — DE/* */LETE concatenation, keywords hidden in block/line comments — untested
3. Dollar-quoted and double-quoted string stripping — feature exists, zero test coverage
4. 20 of 28 mutation keywords had no test (INSERT, DELETE, UPDATE, DROP, ALTER, TRUNCATE, CREATE, GRANT, REVOKE, VACUUM, LISTEN, UNLISTEN, PREPARE, EXECUTE, DEALLOCATE, REINDEX, MERGE, CALL, REFRESH, DISCARD)
5. 17 of 29 dangerous functions had no test (lo_unlink, pg_read_binary_file, pg_cancel_backend, pg_reload_conf, all advisory lock variants, etc.)

Fix: +48 tests (16 → 64) covering all mutation keywords, dangerous functions, bypass prevention, and string-stripping behavior.