fix(codebox-db): grant what wp-codebox's external MySQL provider needs

[chubes4]

Fixes the root cause of Extra-Chill/homeboy#15333.

Problem

homeboy review test <wordpress component> on the managed VPS reports PHPUNIT_ZERO_TESTS cause=recipe_run_no_executions, including on clean main. The real failure is one phase earlier, in the wp-codebox recipe evidence:

provision_runtime_services failed: Managed runtime service failed: wordpress-database (provider external, provision-failed, ~25ms)

wp-codebox's external MySQL provider (packages/cli/src/runtime-services.ts, provisionMysqlExternalService) uses the configured account as a host-side provisioner:

1. SELECT … information_schema.SCHEMATA …; SELECT … FROM mysql.user WHERE User=… AND Host='%' (namespace-unused preflight)
2. CREATE DATABASE wp_codebox_<hex>
3. CREATE USER wpcb_<hex>@'%' + GRANT ALL ON wp_codebox_<hex>.* to it
4. hands the sandbox only the per-run user, and drops both afterwards

The account this module provisions (wp_coding_agents_codebox@127.0.0.1) had only ALL ON \codebox_%`.*: the wrong prefix, no CREATE USER, no grant option, and no mysql.userread. Step 1 is denied, so nothing ever runs. Verified live:SHOW GRANTSshows exactly that, andmysqladmin ping` with the account succeeds, so connectivity is fine.

Why not loosen wp-codebox instead: it deliberately never projects the provisioning credential into the sandbox (tested invariant runtime-service-admin-env-exposed, and a failed CREATE USER is fatal by test). Falling back to the provisioner account inside the sandbox would break that.

Change

GRANT ALL PRIVILEGES ON `wp\_codebox\_%`.* TO 'wp_coding_agents_codebox'@'127.0.0.1' WITH GRANT OPTION;
GRANT CREATE USER ON *.* TO 'wp_coding_agents_codebox'@'127.0.0.1';
GRANT SELECT (User, Host) ON mysql.user TO 'wp_coding_agents_codebox'@'127.0.0.1';

• Data privileges and grant option apply only to wp_codebox_% databases. Nothing touches the site database.
• mysql.user is column-scoped to User, Host, so password hashes stay unreadable.
• CREATE USER is global by MySQL design. Tradeoff: it also permits DROP USER / RENAME USER on any account, which is a denial-of-service risk but gives no data access. The same environment already holds the site's wp-config.php credentials with ALL on production data, so the marginal exposure is small. This needs an explicit reviewer call.
• The tests now pin this exact grant set: one global grant only, no ALL … ON *.*, no unscoped mysql.user read.

Verification

• bash tests/codebox-database.sh → 21/21 assertions passed. bash -n is clean.
• ⚠️ Not applied live. This agent has no MySQL root or sudo. Applying it needs ./upgrade.sh --systems-capabilities managed-vps as root. Afterwards, homeboy review test data-machine-events --placement local should execute tests. The old codebox\_% grant is left in place and is harmless.

Provenance

Written directly by Extra Chill Bot (OpenCode in Discord, operator-requested). Cook is still blocked by homeboy#15331 until #15339 ships.

🤖 AI-assisted: authored by Extra Chill Bot, pending human review.

[chubes4]

Closing: wrong direction. Components should run PHPUnit on wp-codebox's built-in mdi-native database (markdown-database-integration) instead of provisioning MySQL users on the host. Following up by moving data-machine-events to mdi-native. Extra Chill Bot