[devopam]

Fixes #353

Summary

• SQL-safety allowlist: the read-only TimescaleDB functions from the issue (time_bucket, first/last, locf, histogram, interpolate, size/stats functions, show_chunks, by_range/by_hash, uuidv7 helpers, timescaledb_experimental.show_policies) are now allowed. Mutating functions, procedures, timescaledb_pre/post_restore and get_telemetry_report stay blocked.
• New tools (21), design in docs/plans/timescaledb-tools.md, reference in docs/timescaledb.md:
  • reads: get_hypertable_stats, list_timescale_jobs, list_continuous_aggregates, get_timescaledb_telemetry_report
  • additive DDL (MCPG_ALLOW_DDL): add_dimension, set_chunk_time_interval, add_continuous_aggregate_policy, add_reorder_policy, four remove_*_policy
  • admin (new MCPG_ALLOW_TIMESCALEDB_ADMIN, dry_run then confirm=true + confirmation_token): drop_chunks, compress_chunk, decompress_chunk, reorder_chunk, merge_chunks, refresh_continuous_aggregate, run_job, alter_job, delete_job
• Verified on TimescaleDB 2.30.2 (results in the design doc): refresh_continuous_aggregate, merge_chunks_concurrently and reorder_chunk cannot run in a transaction block, so they use an autocommit connection and are refused under tenancy; get_telemetry_report() is local-only.
• New experimental TimescaleDB CI job runs tests/integration/test_timescaledb_integration.py.

Deliberately not included: add_job, enable_chunk_skipping, move_chunk, split_chunk, attach/detach_chunk, convert_to_*, add_columnstore_policy, recompress_chunk (reasons in docs/timescaledb.md).

Roadmap linkage

Advances roadmap row: N/A — new feature requested in #353, no roadmap row

Test plan

• ruff, ruff format, mypy src/mcpg
• unit + contract suites (3078 passed); snapshots, tools.json, doc tables regenerated
• integration tests against a real TimescaleDB 2.30.2 container (7 passed)
• new TimescaleDB CI job green

🤖 Generated with Claude Code

Summary by Sourcery

Expand TimescaleDB support with a safety-scoped SQL allowlist and a complete gated tool family for inspection, policy management, and administration.

New Features:

• Expand TimescaleDB support with read-only introspection, additive dimension and policy management, and gated chunk, continuous-aggregate, and job administration tools.

Bug Fixes:

• Allow the supported read-only TimescaleDB functions through the SQL-safety kernel while continuing to block mutating functions, procedures, restore hooks, and telemetry-report SQL access.

Enhancements:

• Protect destructive and heavy TimescaleDB operations with a dedicated opt-in setting and dry-run confirmation-token workflow, including safeguards for system jobs and tenant-aware autocommit operations.

CI:

• Add an experimental TimescaleDB integration-test CI job using the official TimescaleDB image.

Documentation:

• Document the TimescaleDB tool tiers, configuration gates, confirmation workflow, supported functions, operational constraints, and exclusions.

Tests:

• Add unit, contract, and real TimescaleDB integration coverage for the SQL allowlist and expanded tool family.

Chores:

• Regenerate tool registries, capability mappings, snapshots, and documentation tables for the expanded TimescaleDB surface.

[sourcery-ai]

Sorry @devopam, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 19 hours by commenting @sourcery-ai review. Upgrade to get a review now.