Continuity runbook: Production DB surgery

Task

A second maintainer can run targeted SQL on production Postgres only through scripts/db/surgery-opencreorg.sh, with backup-first and the destructive confirmation phrase when needed.

Success criteria

• Dry-run documented: how to classify a SQL file as destructive vs not
• Operator will not run destructive SQL without exact I_UNDERSTAND_OPENCREORG_PROD_DB_DESTRUCTIVE_ACTION plus --destructive
• No ad-hoc heroku pg:psql workaround in the runbook path
• Runbook docs/continuity/runbooks/production-db-surgery.md (skill continuity-production-db-surgery)

Context

• .cursor/rules/production-db-ops-safety.mdc
• Wrapper does not parse SQL for DROP; humans must pass --destructive when the file deletes/drops

Constraints

• existing maintainers only
• Confirm APP_NAME (default opencreorg) and the SQL file path before running
• Never paste DATABASE_URL

Agent prompt

See Agent prompt in docs/continuity/runbooks/production-db-surgery.md.

Read .cursor/rules/production-db-ops-safety.mdc, scripts/db/surgery-opencreorg.sh, and the existing docs/continuity/runbooks/production-db-surgery.md. Verify the runbook covers dry-run classification, backup-first execution, the exact destructive confirmation and --destructive requirement, APP_NAME and SQL path confirmation, and the prohibition on ad-hoc heroku pg:psql or exposing DATABASE_URL.