Query verification: bolvrk explain

Read-only EXPLAIN of the migration's own queries against the connected schema — sequential scans of large tables, nested loops over sequential scans, large sorts. Never executes a statement.

bolvrk explain takes the UPDATE, DELETE and SELECT statements in a migration and runs each through EXPLAIN (FORMAT JSON) against a database you point it at. Never EXPLAIN ANALYZE, never executed: the whole session is a read-only transaction that is rolled back. Deterministic plan rules — the EX family — then judge the plan: sequential scans of large tables, nested loops over sequential scans, large sorts.

Findings arrive in the same contract as check, so the same policy, the same JSON and the same SARIF apply.

npx bolvrk explain migrations/0042_backfill.sql --db=$SHADOW_DB

Your machine, your credentials

explain runs where the CLI runs. The hosted service never executes a statement of yours and never sees the connection string. Point it at a replica or a shadow database, and use the read-only role from the setup guide — the CLI warns when the role it connected with could write.

Also in Deterministic rule engine

• Postgres migration safety checks
• Real parse-tree analysis
• Severity taxonomy
• Evidence-backed rules
• False-positive discipline
• Fuzz-tested boundaries
• A corpus of 69 rules
• Credential rules: no secret ever reaches the repo
• Secret scanning for any file: bolvrk secrets
• Performance rules: indexing and query health