insika 0.3.0 → 0.7.0

data/lib/insika/retention.rb

@@ -22,6 +22,11 @@ module Insika
     # KEY — memory TTLs sweep on their own knob (`memory_ttl_days`), gated by
     # neither retention_days nor the age-based claim (D5).
     MEMORY_TTL_KEY = "memory_ttl_claim"
+    # the ARTIFACT TTL's own daily claim — same discipline as the memory TTL:
+    # reports expire on their own knob (`artifact_ttl_days`), never gated by
+    # retention_days (a deployment that keeps conversations forever must still
+    # expire the PII-carrying reports).
+    ARTIFACT_TTL_KEY = "artifact_ttl_claim"
     WINDOW = 86_400 # one sweep per day, at most
 
     TERMINAL = %w[completed failed cancelled].freeze
@@ -32,7 +37,8 @@ module Insika
                     settings_store: nil, budget_ledger: nil, funnel_store: nil,
                     followup_store: nil, contact_store: nil, proposal_store: nil,
                     model_visible_trace_store: nil,
-                     store:, window: WINDOW, now: nil, harvest_store: nil)
+                     store:, window: WINDOW, now: nil, harvest_store: nil,
+                     artifact_store: nil)
       @session_store = session_store
       @task_store = task_store
       @checkpoint_store = checkpoint_store
@@ -53,6 +59,7 @@ module Insika
       @window = window
       @now = now # injectable for specs (a deterministic "today")
       @harvest_store = harvest_store #  ; nil = nothing to sweep
+      @artifact_store = artifact_store #  ; nil = nothing to sweep
     end
 
     # the sweep reads the memory store's cells/records (specs seed
@@ -68,11 +75,13 @@ module Insika
     def run
       budget_cells = sweep_budget_cells
       memory_ttl = sweep_memory_ttl
+      artifacts = sweep_artifacts
       days = retention_days
       unless days.to_i.positive? && claim_window
         summary = { claimed: false }
         summary[:budget_cells] = budget_cells if budget_cells
         summary[:memory_ttl] = memory_ttl if memory_ttl
+        summary[:artifacts] = artifacts if artifacts
         return summary
       end
 
@@ -101,6 +110,7 @@ module Insika
       summary[:harvest] = @harvest_store.delete_older_than(cutoff) if @harvest_store
       summary[:budget_cells] = budget_cells if budget_cells
       summary[:memory_ttl] = memory_ttl if memory_ttl
+      summary[:artifacts] = artifacts if artifacts
       summary
     end
 
@@ -166,6 +176,31 @@ module Insika
       end
     end
 
+    # the artifact TTL sweep — the guarantee that PII inside a report expires
+    # even though no reader can see inside the opaque HTML. Its OWN daily
+    # claim + knob (`artifact_ttl_days` from settings; Integer; nil/absent =
+    # OFF), never gated by retention_days — a deployment that keeps its
+    # conversations forever must still expire the reports (the memory-TTL
+    # reasoning). -> Integer (removed) | nil (no knob, or the claim is held).
+    def sweep_artifacts
+      ttl = artifact_ttl_days
+      return nil if ttl.nil? || ttl <= 0
+      return nil unless claim(ARTIFACT_TTL_KEY)
+
+      @artifact_store.delete_older_than(now - ttl * 86_400)
+    end
+
+    # settings["artifact_ttl_days"]: Integer days. nil/blank/non-numeric -> nil
+    # (OFF — parity, never a crash at sweep time).
+    def artifact_ttl_days
+      return nil unless @settings_store
+
+      value = @settings_store.get["artifact_ttl_days"]
+      value.to_s.empty? ? nil : Integer(value)
+    rescue ArgumentError, TypeError
+      nil
+    end
+
     # -> [[scope, Time]] — one per existing cell with a resolved TTL. The
     # setting is passed in (one settings-store read per sweep — the caller
     # already resolved it).

data/lib/insika/router/app.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "json"
+require "rack/request"
+require "async/http/client"
+require "async/http/endpoint"
+require "protocol/http/body/buffered"
+require_relative "session_key"
+require_relative "proxy_body"
+
+module Insika
+  module Router
+    # The standalone Rack/Async app: session-key extraction →
+    # consistent-hash pick → proxy, on the same Async/Falcon stack the engine
+    # already runs on. A request whose key has no live owner (nothing found,
+    # or the ring itself is empty) round-robins; a request whose chosen
+    # backend is unreachable answers the retry envelope — it is NOT
+    # retried against a different backend (§3.5): that backend may already
+    # hold a durable, at-most-once claim on the task this request names.
+    class App
+      DEFAULT_BODY_MAX_BYTES = 262_144 # 256 KiB — small JSON control payloads, never uploads (§5)
+      RETRY_AFTER_SECONDS = 1
+      HOP_BY_HOP = %w[connection keep-alive proxy-connection transfer-encoding upgrade host content-length].freeze
+
+      # client_factory: (backend_url, timeout) -> an object answering #call(request)
+      # -> Protocol::HTTP::Response. Defaults to a real Async::HTTP::Client;
+      # a spec injects a fake instead of opening real sockets.
+      def initialize(pool:, body_max_bytes: DEFAULT_BODY_MAX_BYTES, backend_timeout: 10, logger: $stdout,
+                     client_factory: DEFAULT_CLIENT_FACTORY)
+        @pool = pool
+        @body_max_bytes = body_max_bytes
+        @backend_timeout = backend_timeout
+        @logger = logger
+        @client_factory = client_factory
+        @clients = {} # backend address -> memoized client (persistent connections)
+        @clients_mutex = Mutex.new
+        @rr_index = -1
+      end
+
+      DEFAULT_CLIENT_FACTORY = lambda do |backend, timeout|
+        Async::HTTP::Client.new(Async::HTTP::Endpoint.parse(backend, timeout: timeout))
+      end
+      private_constant :DEFAULT_CLIENT_FACTORY
+
+      def call(env)
+        req = Rack::Request.new(env)
+        segments = req.path_info.split("/").reject(&:empty?)
+
+        return health_response if req.request_method == "GET" && segments == ["up"]
+
+        raw_body = read_body(env)
+        backend = pick_backend(req.request_method, segments, raw_body)
+        return unavailable_response if backend.nil?
+
+        proxy(req, backend, raw_body)
+      end
+
+      private
+
+      def pick_backend(method, segments, raw_body)
+        backends = @pool.backends
+        return nil if backends.empty?
+
+        key = session_key(method, segments, raw_body)
+        return @pool.ring.backend_for(key) if key
+
+        @rr_index = (@rr_index + 1) % backends.size
+        backends[@rr_index]
+      end
+
+      def session_key(method, segments, raw_body)
+        return nil if raw_body.nil?
+
+        if raw_body.bytesize > @body_max_bytes
+          log("router: body #{raw_body.bytesize}B exceeds body_max_bytes=#{@body_max_bytes} — " \
+              "skipping session-key extraction (round-robin), forwarding it whole regardless")
+          return nil
+        end
+
+        SessionKey.extract(method, segments, body: -> { JSON.parse(raw_body) })
+      end
+
+      # Reads the WHOLE body (it must be forwarded intact) — `body_max_bytes`
+      # only bounds how much of it #session_key will try to parse as JSON,
+      # never how much reaches the backend (§3.1, §5).
+      def read_body(env)
+        input = env["rack.input"]
+        return nil if input.nil?
+
+        data = input.read
+        input.rewind if input.respond_to?(:rewind)
+        data.nil? || data.empty? ? nil : data
+      end
+
+      def proxy(req, backend, raw_body)
+        client = client_for(backend)
+        path = req.script_name.to_s + req.path_info
+        path += "?#{req.query_string}" unless req.query_string.to_s.empty?
+        body = raw_body ? Protocol::HTTP::Body::Buffered.wrap(raw_body) : nil
+
+        response = client.call(
+          Protocol::HTTP::Request.new(nil, nil, req.request_method, path, nil,
+                                      forward_headers(req), body)
+        )
+        [response.status, response_headers(response), response.body ? ProxyBody.new(response.body) : []]
+      rescue StandardError => e
+        log("router: backend #{backend} unreachable (#{e.class}: #{e.message})")
+        unavailable_response
+      end
+
+      def client_for(backend)
+        @clients_mutex.synchronize { @clients[backend] ||= @client_factory.call(backend, @backend_timeout) }
+      end
+
+      def forward_headers(req)
+        headers = Protocol::HTTP::Headers.new
+        req.each_header do |key, value|
+          next unless key.start_with?("HTTP_")
+
+          name = key.sub(/\AHTTP_/, "").tr("_", "-").downcase
+          headers.add(name, value) unless HOP_BY_HOP.include?(name)
+        end
+        headers.add("content-type", req.content_type) if req.content_type
+        headers
+      end
+
+      def response_headers(response)
+        headers = {}
+        response.headers&.each do |key, value|
+          name = key.to_s
+          headers[name] = headers.key?(name) ? Array(headers[name]) + [value] : value
+        end
+        headers
+      end
+
+      def health_response
+        json_response(200, { status: "ok", backends: @pool.backends.size })
+      end
+
+      def unavailable_response
+        json_response(503, { error: { class: "Insika::Router::BackendUnavailable",
+                                       message: "no backend reachable",
+                                       retryable: true, retry_after: RETRY_AFTER_SECONDS } })
+      end
+
+      def json_response(status, body)
+        [status, { "content-type" => "application/json" }, [JSON.generate(body)]]
+      end
+
+      def log(message)
+        @logger&.puts(message)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/insika/router/backend_pool.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "resolv"
+require_relative "hash_ring"
+
+module Insika
+  module Router
+    # Backend discovery + the ring it feeds. Two modes:
+    #
+    #   static — a fixed list, resolved once (the Railway shape: N local
+    #     Falcon workers on known ports inside one container).
+    #   dns    — one hostname re-resolved on an interval (the Kubernetes
+    #     shape: a headless Service, one A/AAAA record per ready pod).
+    #
+    # The ring is rebuilt ONLY when the resolved set actually changed — a DNS
+    # poll that returns the same pods is a no-op, not a ring rebuild every
+    # `dns_interval` seconds.
+    class BackendPool
+      def initialize(static: nil, dns: nil, dns_port: nil, dns_interval: 15,
+                      replicas: HashRing::DEFAULT_REPLICAS, resolver: Resolv, logger: $stdout)
+        raise ArgumentError, "static or dns is required, not both" if static.nil? == dns.nil?
+        raise ArgumentError, "dns_port is required with dns:" if dns && dns_port.nil?
+        raise ArgumentError, "static must not be empty" if static && Array(static).empty?
+
+        @static = Array(static)
+        @dns = dns
+        @dns_port = dns_port
+        @dns_interval = dns_interval
+        @replicas = replicas
+        @resolver = resolver
+        @logger = logger
+        @mutex = Mutex.new
+        @ring = nil
+        refresh!
+      end
+
+      def dns? = !@dns.nil?
+
+      def ring
+        @mutex.synchronize { @ring }
+      end
+
+      def backends
+        @mutex.synchronize { @ring&.backends || [] }
+      end
+
+      # Re-resolves (a no-op for static after the first call) and rebuilds
+      # the ring iff the resolved set changed. -> bool (did it change?).
+      def refresh!
+        resolved = @dns ? resolve_dns : @static
+        if resolved.empty?
+          log("router: 0 backends resolved — keeping the previous ring" \
+              "#{" (#{@ring.backends.size} backend(s))" if @ring}")
+          return false
+        end
+
+        @mutex.synchronize do
+          return false if @ring && @ring.backends.sort == resolved.sort
+
+          @ring = HashRing.new(resolved, replicas: @replicas)
+        end
+        log("router: ring rebuilt — #{resolved.sort.join(', ')}")
+        true
+      end
+
+      # Starts the periodic re-resolve loop (dns mode only — a no-op for
+      # static) inside the caller's Async task, so a spec can drive #refresh!
+      # directly without ever starting this loop.
+      def start_polling(task)
+        return unless dns?
+
+        task.async do |t|
+          loop do
+            t.sleep(@dns_interval)
+            refresh!
+          rescue StandardError => e
+            log("router: DNS re-resolve failed (#{e.class}: #{e.message}) — keeping the previous ring")
+          end
+        end
+      end
+
+      private
+
+      def resolve_dns
+        @resolver.getaddresses(@dns).map { |ip| "http://#{ip.include?(':') ? "[#{ip}]" : ip}:#{@dns_port}" }
+      rescue StandardError => e
+        log("router: DNS resolve of #{@dns} failed (#{e.class}: #{e.message})")
+        []
+      end
+
+      def log(message)
+        @logger&.puts(message)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/insika/router/hash_ring.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "zlib"
+
+module Insika
+  module Router
+    # Ketama-style consistent hash ring. Each backend gets
+    # `replicas` virtual points on a 0..2**32-1 circle (CRC32 of "backend#i");
+    # a key's owner is the first point clockwise from CRC32(key). Removing or
+    # adding one backend only remaps the ~1/N of the space that belonged to
+    # that backend's own points — not the whole ring — which is what keeps a
+    # rolling deploy from bouncing every live session to a new owner at once.
+    class HashRing
+      DEFAULT_REPLICAS = 160
+
+      def initialize(backends, replicas: DEFAULT_REPLICAS)
+        raise ArgumentError, "at least one backend is required" if Array(backends).empty?
+
+        @replicas = replicas
+        @backends = backends.uniq.sort
+        @ring = {}
+        @backends.each do |backend|
+          @replicas.times { |i| @ring[Zlib.crc32("#{backend}\0#{i}")] = backend }
+        end
+        @points = @ring.keys.sort
+      end
+
+      attr_reader :backends, :points, :ring
+
+      # -> the backend owning `key` — the first ring point at or after
+      # CRC32(key), wrapping around to the first point when `key` hashes past
+      # the last one. O(log N) via binary search, not a hash-map rebuild.
+      def backend_for(key)
+        backend_for_point(Zlib.crc32(key.to_s))
+      end
+
+      # Fraction of a representative KEY SAMPLE whose owner changes between
+      # two rings — the measurement acceptance §6.2 asks for, not an
+      # assumption. (Ring POINTS themselves are the wrong yardstick: a's/b's/
+      # c's/d's own points stay put when "e" is added — only the space of
+      # arbitrary keys BETWEEN points shifts.) `sample_size` large enough that
+      # the law of large numbers keeps the estimate tight without a spec
+      # needing thousands of literal keys of its own.
+      def self.remapped_fraction(before, after, sample_size: 20_000)
+        moved = (0...sample_size).count { |i| before.backend_for(i) != after.backend_for(i) }
+        moved.to_f / sample_size
+      end
+
+      def backend_for_point(point)
+        idx = @points.bsearch_index { |p| p >= point } || 0
+        @ring[@points[idx]]
+      end
+    end
+  end
+end

data/lib/insika/router/proxy_body.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Insika
+  module Router
+    # Streams an upstream `Protocol::HTTP::Response` body back to the
+    # downstream client. Exposes `#call(stream)`, NOT `#each` — the same
+    # discovery `Server::SSEBody` documents: under protocol-rack/protocol-http1
+    # (the stack of Async::HTTP::Server AND Falcon), a body that only responds
+    # to `#each` is routed to `Body::Enumerable`, whose `read` runs the `#each`
+    # in a plain Enumerator Fiber where `Async::Task.current` is unavailable —
+    # so a long-running SSE turn proxied through this router would come out
+    # empty. `#call` routes it to `Body::Streaming` instead, scheduled via
+    # `Fiber.schedule` under the reactor, which is what makes an SSE stream
+    # drain through the router with no added buffering beyond the one-time
+    # request-body read (§6.5).
+    class ProxyBody
+      def initialize(upstream_body)
+        @upstream_body = upstream_body
+      end
+
+      def call(stream)
+        @upstream_body.each { |chunk| stream.write(chunk) }
+      rescue StandardError
+        # The downstream client disconnected, or the upstream connection
+        # dropped mid-stream: no exception escapes (same rule as SSEBody) —
+        # the turn itself belongs to the backend, not this connection.
+        nil
+      ensure
+        @upstream_body.close
+        stream.close
+      end
+    end
+  end
+end

data/lib/insika/router/session_key.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Insika
+  module Router
+    # Session-key extraction, matched to the routes that
+    # actually carry production traffic in `Server::App` today. The RFC's own
+    # sketch of a path-based `/api/widget/sessions/:token/…` route was written
+    # from memory and does not match what `server/app.rb` implements — the
+    # widget/relay surface is `POST /channels/:id/messages` (and `/events`),
+    # with the session id as `session_id` in the JSON body, not a path
+    # segment. `/v1/responses` and `/v1/messages` carry it as `user`. Every
+    # other route (health checks, `/studio/*`, onboarding) has no session key
+    # and round-robins — none of them depend on a worker's in-memory
+    # `SessionActor` (§3.1 point 3).
+    module SessionKey
+      BODY_FIELD_BY_ROUTE = {
+        %w[v1 responses] => "user",
+        %w[v1 messages] => "user"
+      }.freeze
+
+      module_function
+
+      # segments: the request path split on "/" with empty parts removed.
+      # body: a zero-arg callable returning the parsed JSON body (a Hash) —
+      # called AT MOST ONCE, and only when a route that carries a session key
+      # actually matches, so a GET or an unrelated POST never pays for a
+      # parse. A malformed body yields no key (the backend's own parser is
+      # what answers the client's 400/422), never a router-level error.
+      def extract(method, segments, body:)
+        return nil unless method == "POST"
+
+        field =
+          if segments.length == 3 && segments[0] == "channels" && %w[messages events].include?(segments[2])
+            "session_id"
+          else
+            BODY_FIELD_BY_ROUTE[segments]
+          end
+        return nil unless field
+
+        read_field(body, field)
+      end
+
+      def read_field(body, field)
+        parsed = body.call
+        return nil unless parsed.is_a?(Hash)
+
+        value = parsed[field] || parsed[field.to_sym]
+        Insika::Coercion.present?(value) ? value.to_s : nil
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/insika/router.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Session-sticky router. NOT required by `require "insika"` (like
+# server/ and the Studio, it pulls in async-http and is only needed by an
+# operator who actually runs `bin/insika-router`): the engine's serving path
+# (`insika serve` / `DSL::ServerBoot` / `WEB_CONCURRENCY=1`) is completely
+# unaffected by this file's existence — the router is additive infrastructure
+# for whoever chooses to scale past one worker, never a default.
+require_relative "coercion"
+require_relative "router/hash_ring"
+require_relative "router/session_key"
+require_relative "router/backend_pool"
+require_relative "router/app"
+
+module Insika
+  module Router
+  end
+end

data/lib/insika/schedule.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+module Insika
+  # the parsed recurring-schedule declaration of ONE agent —
+  # the ONLY shape the engine accepts, shared by the ScheduleEngine, the
+  # doctor and the Studio. Pure value object (the followup-policy precedent).
+  #
+  # One schedule: a name, a trigger (`cron` OR `every`, never both), a
+  # timezone for cron materialization, the synthetic inbound message, a
+  # session mode (a fresh session per run, or a standing one), per-run
+  # overrides (turn_timeout / max_tool_calls / model) and an enabled flag.
+  #
+  # `parse` returns nil on a malformed hash (the engine SKIPS, the doctor
+  # explains, the Studio refuses); `parse!` raises Insika::ValidationError
+  # naming the exact defect.
+  class Schedule
+    SESSION_MODES = %w[new fixed].freeze
+    OVERRIDE_KEYS = %w[turn_timeout max_tool_calls model].freeze
+    ID_RE = /\A[a-z][a-z0-9_-]*\z/
+
+    attr_reader :id, :every, :cron, :tz, :message, :session_mode, :session_id,
+                :overrides, :enabled
+
+    def self.parse(hash)
+      new(hash)
+    rescue Insika::ValidationError
+      nil
+    end
+
+    def self.parse!(hash)
+      new(hash)
+    end
+
+    def initialize(hash)
+      raise Insika::ValidationError, "schedule: declaration must be a Hash" unless hash.is_a?(Hash)
+
+      h = hash.transform_keys(&:to_s)
+      @id = id_of(h)
+      @every = every_of(h)
+      @cron = cron_of(h)
+      if @cron.nil? && @every.nil?
+        raise Insika::ValidationError,
+              "schedule '#{@id}': a trigger is required — declare cron or every"
+      end
+      @tz = tz_of(h)
+      @message = message_of(h)
+      @session_mode = session_mode_of(h)
+      @session_id = session_id_of(h)
+      @overrides = overrides_of(h)
+      @enabled = h.key?("enabled") ? h["enabled"] == true : true
+      freeze
+    end
+
+    def cron? = !@cron.nil?
+    def every? = !@every.nil?
+    def fixed_session? = @session_mode == "fixed"
+
+    def to_h
+      { "id" => @id, "cron" => @cron, "every" => @every, "tz" => @tz,
+        "message" => @message, "session_mode" => @session_mode,
+        "session_id" => @session_id, "overrides" => @overrides,
+        "enabled" => @enabled }.compact
+    end
+
+    private
+
+    def id_of(h)
+      id = h["id"].to_s.strip.downcase
+      unless ID_RE.match?(id)
+        raise Insika::ValidationError,
+              "schedule.id must match #{ID_RE.inspect}, got: #{h['id'].inspect}"
+      end
+
+      id
+    end
+
+    def every_of(h)
+      every = h["every"]
+      return nil if every.nil?
+
+      unless every.is_a?(Integer) && every.positive?
+        raise Insika::ValidationError,
+              "schedule.every must be a positive integer of seconds, got: #{h['every'].inspect}"
+      end
+
+      every
+    end
+
+    def cron_of(h)
+      cron = h["cron"]
+      return nil if cron.nil?
+
+      if h.key?("every") && !h["every"].nil?
+        raise Insika::ValidationError,
+              "schedule '#{@id}': cron and every are mutually exclusive — declare exactly one trigger"
+      end
+
+      Insika::Cron.new(cron) # raises ValidationError on a malformed expression
+      cron.to_s
+    end
+
+    def tz_of(h)
+      tz = h["tz"].to_s
+      tz = "Etc/UTC" if tz.empty?
+      unless Insika::Timezone.known?(tz)
+        raise Insika::ValidationError, "schedule '#{@id}'.tz is not a valid IANA timezone: #{tz.inspect}"
+      end
+
+      tz
+    end
+
+    def message_of(h)
+      message = h["message"]
+      if Coercion.blank?(message)
+        raise Insika::ValidationError,
+              "schedule '#{@id}'.message is required — the synthetic inbound that kicks each run"
+      end
+
+      message.to_s
+    end
+
+    def session_mode_of(h)
+      mode = h["session_mode"]
+      return "new" if mode.nil?
+
+      mode = mode.to_s
+      unless SESSION_MODES.include?(mode)
+        raise Insika::ValidationError,
+              "schedule '#{@id}'.session_mode must be one of #{SESSION_MODES.inspect}, got: #{h['session_mode'].inspect}"
+      end
+
+      mode
+    end
+
+    def session_id_of(h)
+      session_id = h["session_id"]
+      return nil if session_id.nil?
+
+      session_id.to_s
+    end
+
+    def overrides_of(h)
+      overrides = h["overrides"]
+      return nil if overrides.nil?
+
+      raise Insika::ValidationError, "schedule '#{@id}'.overrides must be a Hash" unless overrides.is_a?(Hash)
+
+      overrides = overrides.transform_keys(&:to_s)
+      unknown = overrides.keys - OVERRIDE_KEYS
+      unless unknown.empty?
+        raise Insika::ValidationError,
+              "schedule '#{@id}'.overrides: unknown key(s) #{unknown.inspect} " \
+              "(allowed: #{OVERRIDE_KEYS.join(', ')})"
+      end
+
+      overrides.each do |key, value|
+        # model is a provider/model REF — validated at declaration, not left
+        # for model-resolution time; everything else is an integer ceiling.
+        if key == "model"
+          if !value.is_a?(String) || value.strip.empty?
+            raise Insika::ValidationError,
+                  "schedule '#{@id}'.overrides.model must be a non-blank String (a " \
+                  "model ref), got: #{value.inspect}"
+          end
+          next
+        end
+
+        unless value.is_a?(Integer) && value.positive?
+          raise Insika::ValidationError,
+                "schedule '#{@id}'.overrides.#{key} must be a positive Integer, got: #{value.inspect}"
+        end
+      end
+
+      overrides
+    end
+  end
+end