feat(manifest): close sidecar storage set — drop json, validate up front (V-L2-F2)

[hyperpolymath]

Closes #112.

Decision: drop the JSON sidecar store (not implement)

#112's first acceptance criterion is the decision itself — implement a JSON store vs. drop the option. This PR drops it. Rationale:

• No storage-abstraction layer exists. Provenance, temporal, drift, and gc are all hardwired to SQLite via rusqlite. A JSON store "with the same octad-dimension coverage as the sqlite path" would mean re-encoding every storage-layer invariant SQL gives us for free (closed-enum CHECKs, the partial-unique "one current version" index, self-edge prevention, valid_to >= valid_from) in hand-written Rust.
• postgres is already generate-only. Even the existing second backend isn't runtime-supported by drift/gc, so a runtime JSON store would be out of step with the codebase's maturity.
• json is in neither the ROADMAP nor the README's vision. The README describes the envisioned alternative backends as sqlite | file | verisim — json isn't among them.
• A half-built JSON store would re-introduce exactly the advertised-but-broken surface this issue exists to remove.

If a flat-file store is wanted later, it should be designed against a real storage trait and re-added — the code documents this path.

What changed

The supported [sidecar].storage set is now closed and validated: sqlite (default, full runtime support) and postgres/postgresql (PostgreSQL DDL dialect for generate). Everything else — including json — is rejected uniformly and up front, with no "coming soon / #112" promise.

Area	Change
codegen::overlay::SqlDialect::from_storage	Removed the json special-case arm + its #112 pointer; json now falls through to the generic unsupported value error. Documented as the single source of truth for the closed set.
manifest::validate_manifest	New sidecar-storage-supported check (reuses from_storage), so validate/doctor/generate can't disagree — an unsupported store fails at validate time, not only at generate.
Docs	SidecarConfig (manifest + abi) docs, the generate comment, and the manifest template no longer advertise json; the template now documents the closed set.
gc test	Now exercises the realistic non-sqlite case (postgres) rather than the removed json value.

Testing

• cargo test — 120 lib unit tests + 21 integration/e2e tests pass (new: unsupported_storage_fails_storage_check, postgres_storage_passes_storage_check; updated: test_storage_to_dialect_mapping, gc_rejects_non_sqlite_backend).
• cargo fmt --check clean.
• cargo clippy --all-targets -- -D warnings clean.

Reversibility

No working config depends on json (it was already rejected at generate). Re-adding a real store later is a localized change to the from_storage match. If you'd actually prefer this issue resolved by implementing a JSON backend instead, say so on this draft and I'll switch approach.

---

Generated by Claude Code

[hyperpolymath]

Closing as a duplicate of #144, which landed on main concurrently and resolved #112 with the same approach (drop the json sidecar store; same from_storage cleanup and the same new sidecar-storage-supported validate check). #112 is already closed as completed.

The only material difference this PR had over #144 was two test-only improvements — a positive postgres_storage_passes_storage_check and a more realistic gc fixture. Those have been salvaged into #147 (branched off current main), so nothing is lost here.

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 80 issues detected

Severity	Count
🔴 Critical	1
🟠 High	7
🟡 Medium	72

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@stable needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@master needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence