Expose every database-readable relation to Catalyst

[pmanko]

Why

Runtime discovery described the database relations available to the read-only
role, but model requests and validation still froze availability to curated
catalog metadata. A newly readable relation could therefore be hidden, and a
catalog refresh could fail when no curated relation remained.

What changed

• Derive the writer, editor, validator, and governed execution surface from
  current database permissions on each catalog refresh.
• Keep curated metadata as descriptions and semantic guidance; it no longer
  controls relation availability.
• Respect table-level and column-level SELECT permissions, exposing only
  readable columns. PostgreSQL internal bookkeeping schemas remain excluded.
• Keep the public approvedViews field for compatibility while populating it
  with the runtime-readable relation set.
• Remove outdated allowlist wording and the live smoke test's fixed
  single-relation assertion.

Proof

• Integrated tests start with metadata for relation A, discover only relation
  B, then prove B reaches the writer, human validation, and execution.
• Gateway suite: 342 passed, 3 skipped.
• Ruff formatting and checks pass.
• The live smoke script parses cleanly and now compares with the actual runtime
  catalog without requiring a fixed count.
• Two independent code reviews found no remaining actionable issue.

No live stack reset, seed, deployment, or data change was performed. The later
real-database qualification remains a separate owner-gated step.

Not changed

This does not change database grants or schema, startup behavior, the read-only
account and transaction, time and result limits, session-context behavior, or
published catalog-v6 evidence.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR updates Catalyst/Gateway to derive the queryable relation surface from current DB read permissions (via runtime discovery), while keeping curated catalog metadata only for semantics and descriptions.

Changes:

• Populate the query contract’s approvedViews (legacy field name) from the runtime-readable relation set rather than curated allowlists.
• Respect schema/table/column-level SELECT permissions during discovery and expose only readable columns.
• Update tests and docs to reflect “request catalog / readable relations” wording and remove the live smoke test’s single-relation assumption.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/e2e/test_mvp_live.sh	Live smoke test now fetches runtime catalog and compares it to the contract’s approvedViews.
docs/specification.md	Updates spec language to clarify readable-relation surface and legacy approvedViews naming.
docs/med-agent-hub.md	Updates hub explanation and contract rules to match readable-relation catalog behavior.
catalyst-gateway/tests/test_workbench_routes.py	Adds coverage ensuring handwritten queries can use all runtime-readable relations.
catalyst-gateway/tests/test_manual_analytics.py	Updates discovery SQL assertions for column-level privilege checks.
catalyst-gateway/tests/test_catalyst_mvp.py	Adjusts test fixture to validate runtime discovery availability over curated metadata.
catalyst-gateway/tests/test_catalog_runtime.py	Updates runtime catalog tests to assert DB-driven surface, and adds lint coverage for readable relations.
catalyst-gateway/src/catalyst/service.py	Updates editor validation and policy evaluation to use readable/available relations and new wording.
catalyst-gateway/src/catalyst/query_lint.py	Reframes “unapproved view” finding to “not present in request catalog” while keeping rule code.
catalyst-gateway/src/catalyst/query_engine.py	Updates rejection/diagnostic messages to “request/readable catalog” terminology.
catalyst-gateway/src/catalyst/policy.py	Updates invariant violation message to “requested catalog”.
catalyst-gateway/src/catalyst/catalog.py	Removes curated allowlist gating from request catalog; runtime discovery becomes the surface source.
catalyst-gateway/src/catalyst/analytics.py	Discovery now filters columns via has_column_privilege to enforce column-level SELECT.
analytics/README.md	Updates description of overlay semantics now that “approved views” is no longer the availability gate.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.