A pre-deployed command driver: sync/replicate without S_DEVELOP

[jrosskopf]

Closes #85.

The problem

The CLI generated an ABAP class per command, because erpl-adt object run
executes a class that takes no parameters. Two costs:

• It needs S_DEVELOP — a developer authorisation the erpl-rev service user
  does not have on production. The SAP GUI workflow it mirrors needs only
  S_PROGRAM.
• Every value the user types becomes ABAP source, which is why there is an
  escaping module with a 22-case injection suite behind it.

What changed

ZCL_ERPL_REV_CLIDRV is deployed once, by setup, like everything else. The CLI
writes a command into the DuckDB table _erpl_rev_cli_cmd as JSON; the driver
claims it, executes it, writes the result back. Parameters arrive as data and
are only ever read as values. Nothing is generated, created or deleted in SAP.

All four verbs — replicate, sync create, sync run, schedule — use it when
it is available, falling back to codegen when it is not. --print-abap and
--dry-run still take the codegen path, since printing the ABAP is their point.

Claiming is one UPDATE … RETURNING, so two drivers racing cannot take the same
command — the lease idea the delta engine already uses for targets.

The part that actually removes the authorisation

--queue-only writes the command and returns, contacting SAP not at all. It
does not even resolve credentials — prompting for a password to write a row into
a local database would be absurd. The periodic ERPL_REV_DELTA job, which is
already the supported way to run delta on a schedule, drains the queue on each
tick. Exit 3, because "queued" is not "done" and should not be dressed as one.

Proven on A4H, and asserted in the e2e:

$ env -u SAP_USER -u SAP_PASSWORD -u ERPL_REV_SAP_PASSWORD \
      erpl-rev replicate --table T000 --target t000_q --queue-only --yes
Queued as command 1. The periodic ERPL_REV_DELTA job will run it.

(one tick later)
cli 1 replicate DONE rows=2;seconds=0.000

Verification

Unit: 16804 assertions, 154 cases. test_cmd_queue.cpp models the ABAP JSON
reader independently of the C++ builder and asserts a value survives all three
hops — JSON, a SQL string literal, the driver's parser — including the payload
that would inject a second key if the escaping were wrong.

Live: the e2e queues with the credentials stripped from the environment, runs one
heartbeat tick, and asserts the command reached DONE and the rows landed.
e2e 14/14.

Bugs found while building it

Three of my own ABAP mistakes, two of them silent:

• Multi-parameter method calls need named arguments; jstr( x, 'k' ) is only
  valid for one parameter.
• zcl_erpl_rev_util=>query returns rows as a JSON array string, not a
  table, so the driver claims one command per iteration.
• The JSON reader handled only quoted values, and cmd_id is a number. The
  driver claimed a command and then decided there was nothing to run, leaving
  the row stuck in RUNNING — visible only as count=0 when a row plainly
  existed.

And two the e2e caught that manual testing had not: a report writing a list
cannot be SUBMITted from a classrun without capturing the list; and the
leaked-object sweep matched ZCL_ERPL_REV_CLI*, which now includes the permanent
CLIDRV, so it failed on the very object it was meant to ignore.

Docs

security.md, INSTALL.md and the README said sync/replicate need
S_DEVELOP. They no longer do once the driver is deployed, and leaving that
in would send people to grant a developer authorisation to a service account for
no reason. setup still needs it, and still says so.

Not done

What object run ZCL_ERPL_REV_CLIDRV requires of a restricted user is still
unmeasured. I started building a PFCG role granting ADT but not S_DEVELOP and
abandoned it: S_A.SCON does not reach ADT, and assembling one that does without
dragging S_DEVELOP in is real authorisation engineering. The queue path needs
no authorisation at all, so it is both cheaper to prove and the stronger claim —
that is what is tested. The direct path is a latency optimisation.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}