Code & Engineering

PostgreSQL Migration Lock Review

Reviews ONE PostgreSQL migration file for the four statements that lock or rewrite a table that is already in use, and lists only those, one line each with a fixed code, the statement, why it hurts and the fix - or exactly No findings. It catches CREATE INDEX without CONCURRENTLY on an existing table, a not-null or constraint check run in one blocking step, a column type change or volatile default that rewrites the table, and a drop or rename of a column that running code may still read. It leaves out the safe look-alikes, such as an index built concurrently, a column added with a constant default, a constraint added NOT VALID and validated separately, and the drop of a column the file says nothing reads. Use to review a migration before deploy, to plan a zero-downtime change, or to check a schema pull request.

PostgreSQL Migration Lock Review is a tested SKILL.md that reviews ONE PostgreSQL migration file for the four statements that lock or rewrite a table that is already in use, and lists only those, one line each with a fixed code, the statement, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.

Tested 2026-10-26No code, no hidden instructionsv1.0.0 · 6.9 KB · perpetual license

Not for

Query tuning, data correctness after a backfill, MySQL or SQLite syntax, ORMs that generate the SQL at run time and server settings such as lock timeouts. It reads one pasted migration, assumes a currently supported PostgreSQL version and judges only what is written in the file.

Tested, honestly

Tested 2026-10-26 with a strong and a weak model.

SonnetStrong model, claude-sonnet-5-5
Right on all 3 cases, read by hand. On the orders migration it found the plain index and the not-null set in one step, and left out the concurrent index and the column with a constant default. On the invoices migration it found the type change that computes new values and the rename of a column still in use, and left out the drop the file calls unused and the constraint that was added NOT VALID and validated on its own. On the clean events migration it answered exactly No findings.
HaikuWeak model, claude-haiku-5-5
Right on all 3 cases, read by hand. It matched the strong model on both planted files, with sound fixes and the NOT VALID sequence spelled out, and kept every safe look-alike out of its list: the concurrent index, the constant default, the unused column and the validated constraint. On the clean migration, with a plain index on a table created in the same file, it answered exactly No findings.

Full test summary

Example

Our own test text, before and after the skill ran. Excerpts only.

English · claude-sonnet-5-5

Before

-- Deploy note: the old app version keeps serving traffic while this migration runs. -- The orders table has about 300 million rows. CREATE INDEX idx_orders_customer ON orders (customer_id); CREATE INDEX CONCURRENTLY idx_orders_created ON orders (created_at); ALTER TABLE orders ADD COLUMN channel text NOT NULL DEFAULT 'web'; ALTER TABLE orders ALTER COLUMN customer_id SET NOT NULL;

After

INDEX-BLOCKS-WRITES — CREATE INDEX idx_orders_customer ON orders (customer_id) — a non-concurrent build blocks inserts, updates and deletes on orders (about 300 million rows per the file's note) until it finishes, while the old app is still serving traffic — use CREATE INDEX CONCURRENTLY, outside a transaction block…

What is in the file

  • What the PostgreSQL documentation says, as published on 26 October 2026
  • The answer
  • The codes
  • Rules
  • Work in this order
  • Short example

Languages

English. Tried in: English.

License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.

Versions

Current version 1.0.0, updated 2026-10-26. Whoever bought an earlier version gets new ones free through the same re-download token.

  1. v1.0.0 · 2026-10-26

    First release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.

    Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.

FAQ

Is a plain index on a brand-new table reported?

No. A table that this very file creates holds no rows yet, so nothing is blocked. Only an index on a table that already existed, built without CONCURRENTLY, earns a line.

Does a NOT NULL after a validated check count as one step?

No. The documentation says a valid check constraint lets SET NOT NULL skip its scan, so adding the check NOT VALID, validating it and then setting the not-null is treated as the safe sequence.

Which migrations went into the test?

Three migration files we wrote ourselves: an orders change that mixes a concurrent index with a constant-default column, an invoices change that computes a new numeric type and renames a column in use next to a drop the file declares unused, and a clean events change. Each model got every file one time.

What does a safe migration return?

One sentence only: No findings. Anything wrong is reported as a separate line made of the code, the statement, the damage and the repair, while the statements that were read and approved are never recited back.

Share

Read this page as Markdown: /skills/postgres-migration-lock-review.md.

More in Code & Engineering

  • JWT Verification Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.6 KB

    Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the source. It leaves out the safe look-alikes, such as an algorithm list fixed in the verify call, an audience compared in a second step, and a decode that only reads the key id. Use to review login middleware, to audit token handling in a service, or to check an API before release.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • Terraform Plan Risk Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.2 KB

    Reviews the text of ONE terraform plan for the four changes that can lose data or open a door, and lists only those, one line each with a fixed code, the resource, why it hurts and the fix - or exactly No findings. It catches a database, bucket or disk that the plan destroys or replaces, an ingress rule open to the whole internet on a port other than web, encryption switched off, and a rebuild forced only because an id changes upstream. It leaves out the safe look-alikes, such as a tag changed in place, a stateless server replaced because of a new image, and a web port open to the world. Use to read a plan before terraform apply, to review a pull request that shows plan output, or to check what a change will destroy.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • Kubernetes Manifest Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.4 KB

    Reviews ONE Kubernetes Pod or Deployment manifest for the five settings that most often make a workload unsafe or unpredictable, and lists only those, one line each with a fixed code, the container or volume, why it hurts and the fix - or exactly No findings. It catches a container that is privileged or may run as root, an image with no tag or the latest tag, a container with no memory limit, a secret value written as a literal in env, and a hostPath volume. It leaves out the safe look-alikes, such as a pod that sets runAsNonRoot, an image pinned by digest, a read-only configMap volume and a secret read through secretKeyRef. Use to review a manifest before it is applied, to audit a repository of deployments, or to check a Pod that keeps being killed.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • CORS Config Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.2 KB

    Reviews CORS code or server configuration (an Express or Flask handler, an nginx block, a framework setting) for the five mistakes that let a hostile web page read private responses, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a request Origin copied into the allow header while cookies are allowed, a wildcard origin together with credentials, the null origin allowed, an origin check by suffix, substring or an unanchored pattern, and a per-origin allow header sent without Vary Origin. It leaves out the safe look-alikes, such as an exact allow-list with credentials and a public read-only API that answers with a wildcard and no credentials. Use to review CORS code before release, to audit a gateway config, or to debug a browser CORS error that looks like a server mistake.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 19 Oct 2026