[mplemay]

Closes #147

What

Adds the migration drift gate to rowx check (src/rowx/check/drift.py).

• When [tool.rowx.migrate] is configured and the run has SQL to describe, check validates the migration files, opens a read-only checker session (connect_checker), calls Migrator.info (honouring the configured table; create_schemas is passed through but info creates nothing), and closes the session on every path. This happens before any statement is described.
• Any pending, modified, missing or dirty row exits 2 with one summary on stderr: counts per state in that order, up to five sorted versions per state (, ... beyond), and the help line run `rowx migrate run`, or `rowx check --scratch` . No diagnostics are printed; in JSON mode stdout stays empty.
• A missing history table counts as every migration pending (nothing is created).
• --no-drift-check skips the gate.
• --statistics adds migrations checked: N when the gate ran.
• Without [tool.rowx.migrate], behaviour is unchanged (existing goldens untouched).
• Connection, history and file errors from the gate are redacted like other check errors. The drift summary itself (DriftError) skips redaction: it contains only versions, the configured dir and the help line, never the URL; redacting it would turn a short password such as rowx into *** migrate run.

New tests (named)

DB, src/rowx/__tests__/integration/check/test_check_cli.py (goldens in golden/drift_*.txt): test_drift_up_to_date_passes, test_drift_pending_exits_two, test_drift_partially_pending, test_drift_modified_exits_two, test_drift_missing_exits_two, test_drift_dirty_exits_two, test_drift_json_keeps_stdout_empty, test_no_drift_check_bypasses_the_gate, test_without_migrate_config_there_is_no_gate, test_drift_gate_skipped_when_nothing_is_described, test_drift_password_never_appears, test_history_is_read_in_a_read_only_session (a write in the same session fails with 25006).

Unit, src/rowx/__tests__/unit/check/test_drift.py: test_up_to_date_has_no_summary, test_summary_counts_each_state_in_a_fixed_order, test_summary_lists_at_most_five_versions_per_state, test_no_drift_check_flag.

Wiring edits

• src/rowx/check/cli.py: --no-drift-check, passes the gate to run_check, prints migrations checked.
• src/rowx/check/runner.py: run_check takes an optional gate, run once after discovery and before describing; Statistics.migrations.

Spec ambiguities

• checker.md's example summary ("database is 2 migrations behind migrations/: …") differs from feat: add migration drift gate to rowx check #147's format (counts per state, five versions each, help line). I followed feat: add migration drift gate to rowx check #147: database has drifted from /: then one line per state.
• The gate runs only when there is something to describe. If no file has a checked query, there is no checker session, so a configured project with no database URL (or a drifted database) still exits 0, as it does today without [tool.rowx.migrate]. The design says the gate runs "before describing anything", so I read it as part of describing.
• The gate uses its own read-only checker session, opened just before the describe workers' sessions, rather than reusing one of the worker sessions. Both are the same connect_checker session type.
• --scratch doesn't exist yet, but the help line names it as feat: add migration drift gate to rowx check #147 requires.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T02:22:59.650951Z	bea4bb0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.