{
  "schema": 1,
  "sqlstate": "2F003",
  "condition_name": "prohibited_sql_statement_attempted",
  "sources": [
    {
      "id": "src.errcodes.18.6",
      "kind": "upstream_source",
      "source_role": "condition_definition",
      "tag": "REL_18_6",
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "path": "src/backend/utils/errcodes.txt",
      "sha256": "6e8de346643ba84aa3c9c6a73360acfc7b2dfb89162c06c08ce9bf5bcd5bbcba",
      "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/utils/errcodes.txt#L291",
      "lines": "291"
    },
    {
      "id": "src.path.0",
      "kind": "upstream_source",
      "source_role": "resolved_report_context",
      "tag": "REL_18_6",
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "path": "contrib/dblink/dblink.c",
      "sha256": "e4cfaec3a0a1e5d23fded584725e0f6cf7a17321ad99e5fe046e8b7f97416f15",
      "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/dblink/dblink.c#L1488",
      "lines": "1488-1490,2718-2788"
    },
    {
      "id": "src.path.1",
      "kind": "upstream_source",
      "source_role": "resolved_report_context",
      "tag": "REL_18_6",
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "path": "contrib/postgres_fdw/connection.c",
      "sha256": "67fc002657f2c7df6d93cbf99c933cbc103907d1857ed77aedbb85099ea4dda0",
      "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/postgres_fdw/connection.c#L756",
      "lines": "468-472,756-759"
    },
    {
      "id": "src.calls.REL_18_6",
      "kind": "local_artifact",
      "source_role": "source_call_scan",
      "sha256": "9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf"
    }
  ],
  "claims": [
    {
      "id": "identity",
      "statement": "2F003 is prohibited_sql_statement_attempted in SQLSTATE Class 2F.",
      "sources": [
        "src.errcodes.18.6"
      ],
      "method": "Read the fixed errcodes definition row, severity, and macro."
    },
    {
      "id": "resolved-path",
      "statement": "The fixed PostgreSQL 18.6 source contains the report contexts and message variants described on the page.",
      "sources": [
        "src.path.0",
        "src.path.1"
      ],
      "method": "Read the complete source context around the resolved report groups.",
      "limits": "Source confirmation is not a runtime observation in this batch."
    },
    {
      "id": "history-boundary",
      "statement": "Locked release definitions establish catalogue presence from 7.4; they do not establish a precise introducing release or runtime use.",
      "sources": [
        "src.errcodes.18.6"
      ],
      "method": "Compare canonical release facts with the available history boundary.",
      "limits": "Definition presence is not an emitting-path observation."
    }
  ],
  "messages": [
    {
      "id": "message.dblink-results-not-allowed",
      "sqlstate": "2F003",
      "primary_template": "statement returning results not allowed",
      "severity_source": "ERROR",
      "sources": [
        "src.path.0"
      ],
      "limits": "This is dblink no-result API enforcement."
    },
    {
      "id": "message.dblink-credentials-with-hint",
      "sqlstate": "2F003",
      "primary_template": "password or GSSAPI delegated credentials required",
      "detail_template": "Non-superusers may only connect using credentials they provide, eg: password in connection string or delegated GSSAPI credentials",
      "hint_template": "Ensure provided credentials match target server's authentication method.",
      "severity_source": "ERROR",
      "sources": [
        "src.path.0"
      ],
      "limits": "Credential wording and whether HINT is present vary by dblink connection path."
    },
    {
      "id": "message.dblink-credentials-no-hint",
      "sqlstate": "2F003",
      "primary_template": "password or GSSAPI delegated credentials required",
      "detail_template": "Non-superusers must provide a password in the connection string or send delegated GSSAPI credentials.",
      "severity_source": "ERROR",
      "sources": [
        "src.path.0"
      ],
      "limits": "This dblink credential branch has DETAIL but no HINT."
    },
    {
      "id": "message.postgres-fdw-password-required",
      "sqlstate": "2F003",
      "primary_template": "password or GSSAPI delegated credentials required",
      "detail_template": "Non-superuser cannot connect if the server does not request a password or use GSSAPI with delegated credentials.",
      "hint_template": "Target server's authentication method must be changed or password_required=false set in the user mapping attributes.",
      "severity_source": "ERROR",
      "sources": [
        "src.path.1"
      ],
      "limits": "User mapping, authentication method, and password_required setting are deployment-dependent."
    },
    {
      "id": "message.postgres-fdw-scram-pass-through",
      "sqlstate": "2F003",
      "primary_template": "password or GSSAPI delegated credentials required",
      "detail_template": "Non-superusers must delegate GSSAPI credentials, provide a password, or enable SCRAM pass-through in user mapping.",
      "severity_source": "ERROR",
      "sources": [
        "src.path.1"
      ],
      "limits": "This branch has DETAIL and no HINT."
    }
  ],
  "usage_evidence": [
    {
      "scope": "definition",
      "status": "definition_only",
      "evidence_ids": [
        "identity"
      ]
    },
    {
      "scope": "fixed-source-path",
      "status": "source_path_confirmed",
      "evidence_ids": [
        "resolved-path"
      ]
    },
    {
      "scope": "history",
      "status": "unknown",
      "evidence_ids": [
        "history-boundary"
      ]
    },
    {
      "scope": "natural-runtime",
      "status": "unknown",
      "evidence_ids": [
        "resolved-path"
      ]
    }
  ],
  "runtime": []
}