PostgreSQL grants EXECUTE to PUBLIC on every new function by default.
The verification block correctly rejects this, so revoke it before
granting the runtime role.
Cloud SQL's postgres (cloudsqlsuperuser) cannot CREATE OR REPLACE a
function owned by another role. Drop both overloads first so a plain
CREATE works regardless of prior ownership state.
Also removes the dynamic ACL normalization block — a freshly created
function has no stale ACLs to scan and revoke.
Cloud SQL's postgres role is cloudsqlsuperuser, not a true superuser.
After ALTER FUNCTION ... OWNER TO leoclean_kb_stage_owner, it can no
longer revoke ACLs on the transferred function:
ERROR: permission denied for function stage_leoclean_proposal
Reorder so ACL normalization and the runtime GRANT happen while postgres
still owns the function, then transfer ownership. Identical end state.
Observed on teleo-pgvector-standby during M2 Step 4 provisioning
(BOOTSTRAP_EXIT=3 at SQL line 800).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
