Background
stash db push writes the encrypt config into public.eql_v2_configuration (pending → encrypting → active). That table is a v2 + CipherStash Proxy artifact:
- The v2 EQL install SQL creates it (
cipherstash-encrypt.sql:3674) and the config state-machine functions read it; v3 install SQL creates no configuration table at all (cipherstash-encrypt-v3.sql has zero CREATE TABLE/configuration).
- Nothing in the v3 stack reads it — not the SDK (
@cipherstash/stack/protect/drizzle have zero references), and not Proxy (v3 has no reload_config/config surface). v3 encodes config in each column's eql_v3.* domain type.
- CipherStash's own v3 spec calls it out: "retiring the now-redundant
eql_v2_configuration" (docs/superpowers/specs/2026-06-30-eql-v3-text-search-schema-design.md:304).
Bugs this causes today
On a v3-only database, stash eql status checks eql_v2_configuration unconditionally, hits "table not found", and tells the user to "run stash db push to create it" — but db push never creates that table (only the v2 install does), and on a v3-only DB db push itself errors with relation "public.eql_v2_configuration" does not exist. A dead end.
Scope
- Make EQL v3 the default.
stash eql install / eql upgrade default to v3 so --eql-version 3 is no longer required. The v2-only paths (--drizzle, --migration, --migrations-dir, --latest) require an explicit --eql-version 2 (they error with clear guidance otherwise). stash init pins v2 for the Drizzle migration path.
- Stop the CLI recommending
db push. Remove db push recommendations from CLI output — eql status, help/examples, and the encryption-lifecycle guidance (init/setup-prompt, cutover/activate notes). db push remains available for Proxy/v2 users but is no longer surfaced as a default step.
- Guard
db push against a v3-only database with a clean explanatory message instead of a raw Postgres error.
Follow-up to the config-scaffold DX work (#578/#579/#580).
Background
stash db pushwrites the encrypt config intopublic.eql_v2_configuration(pending → encrypting → active). That table is a v2 + CipherStash Proxy artifact:cipherstash-encrypt.sql:3674) and the config state-machine functions read it; v3 install SQL creates no configuration table at all (cipherstash-encrypt-v3.sqlhas zeroCREATE TABLE/configuration).@cipherstash/stack/protect/drizzlehave zero references), and not Proxy (v3 has noreload_config/config surface). v3 encodes config in each column'seql_v3.*domain type.eql_v2_configuration" (docs/superpowers/specs/2026-06-30-eql-v3-text-search-schema-design.md:304).Bugs this causes today
On a v3-only database,
stash eql statuscheckseql_v2_configurationunconditionally, hits "table not found", and tells the user to "runstash db pushto create it" — butdb pushnever creates that table (only the v2 install does), and on a v3-only DBdb pushitself errors withrelation "public.eql_v2_configuration" does not exist. A dead end.Scope
stash eql install/eql upgradedefault to v3 so--eql-version 3is no longer required. The v2-only paths (--drizzle,--migration,--migrations-dir,--latest) require an explicit--eql-version 2(they error with clear guidance otherwise).stash initpins v2 for the Drizzle migration path.db push. Removedb pushrecommendations from CLI output —eql status, help/examples, and the encryption-lifecycle guidance (init/setup-prompt, cutover/activate notes).db pushremains available for Proxy/v2 users but is no longer surfaced as a default step.db pushagainst a v3-only database with a clean explanatory message instead of a raw Postgres error.Follow-up to the config-scaffold DX work (#578/#579/#580).