@derwinjs/db 0.11.0 → 0.13.0

package/prisma/migrations/20260510000000_sprint13_phase9_self_review_verdict/migration.sql

@@ -0,0 +1,73 @@
+-- Sprint 13 Phase 9 (QAP-133) — Recursive self-review verdict audit trail.
+--
+-- Adds:
+--   1. New AttemptStatus enum value `MANUAL_REVIEW_REQUIRED` — set by the
+--      orchestrator when the recursive self-reviewer returns 'fail' or
+--      'manual_review_required'. Blocks dispatch until an operator overrides
+--      via the orchestrate route's `?force=true` query flag.
+--   2. New `derwin.self_review_verdicts` table — one row per self-review call
+--      regardless of outcome. Persisted by both the orchestrator (every fix
+--      cycle) and the admin POST /qa/fix-attempts/:id/self-review route.
+--      The `?force=true` operator-override path also writes here with
+--      verdict='pass' and reasonHints capturing the operator's userId so
+--      every override is auditable.
+--   3. Indexes:
+--        - (projectId) for tenant-scoped scans
+--        - (qaFixAttemptId) for the per-attempt latest-verdict lookup
+--        - (projectId, classification, surface) for cohort dashboards
+--        - (projectId, createdAt DESC) for the recent-verdicts pane
+--   4. Foreign keys to derwin.projects and derwin.qa_fix_attempts (cascade
+--      on delete — deleting a project/attempt removes its verdict trail).
+--
+-- Idempotent (IF NOT EXISTS) — safe to re-run on environments where parts
+-- of the migration already landed.
+
+-- ─── 1. Extend AttemptStatus enum ───────────────────────────────────────────
+-- ALTER TYPE ... ADD VALUE is not transactional in Postgres < 12, but Prisma
+-- supports it on 12+ which is our target. IF NOT EXISTS guards against
+-- re-running on environments where this already landed.
+
+ALTER TYPE "AttemptStatus" ADD VALUE IF NOT EXISTS 'MANUAL_REVIEW_REQUIRED';
+
+-- ─── 2. self_review_verdicts table ──────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS "derwin"."self_review_verdicts" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "qaFixAttemptId" TEXT NOT NULL,
+    "qaTicketId" TEXT NOT NULL,
+    "classification" TEXT NOT NULL,
+    "surface" TEXT NOT NULL,
+    "verdict" TEXT NOT NULL,
+    "reasonHints" TEXT[] NOT NULL,
+    "criticalIssuesFound" INTEGER NOT NULL,
+    "minorIssuesFound" INTEGER NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "self_review_verdicts_pkey" PRIMARY KEY ("id")
+);
+
+-- ─── 3. Indexes ────────────────────────────────────────────────────────────
+
+CREATE INDEX IF NOT EXISTS "self_review_verdicts_projectId_idx"
+    ON "derwin"."self_review_verdicts"("projectId");
+
+CREATE INDEX IF NOT EXISTS "self_review_verdicts_qaFixAttemptId_idx"
+    ON "derwin"."self_review_verdicts"("qaFixAttemptId");
+
+CREATE INDEX IF NOT EXISTS "self_review_verdicts_projectId_classification_surface_idx"
+    ON "derwin"."self_review_verdicts"("projectId", "classification", "surface");
+
+CREATE INDEX IF NOT EXISTS "self_review_verdicts_projectId_createdAt_idx"
+    ON "derwin"."self_review_verdicts"("projectId", "createdAt" DESC);
+
+-- ─── 4. Foreign keys ───────────────────────────────────────────────────────
+
+ALTER TABLE "derwin"."self_review_verdicts"
+    ADD CONSTRAINT "self_review_verdicts_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "derwin"."self_review_verdicts"
+    ADD CONSTRAINT "self_review_verdicts_qaFixAttemptId_fkey"
+    FOREIGN KEY ("qaFixAttemptId") REFERENCES "derwin"."qa_fix_attempts"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/schema.prisma

@@ -153,6 +153,7 @@ model Project {
   tenantFuzzConfig        TenantFuzzConfig?
   rumSamples              RumSample[]
   milestoneEvents         MilestoneEvent[]
+  selfReviewVerdicts      SelfReviewVerdict[]
 
   @@map("projects")
   @@schema("derwin")
@@ -485,9 +486,10 @@ model QAFixAttempt {
   attemptedAt DateTime  @default(now())
   closedAt    DateTime?
 
-  ticket    QATicket        @relation(fields: [qaTicketId], references: [id], onDelete: Cascade)
-  project   Project         @relation(fields: [projectId], references: [id], onDelete: Cascade)
-  artifacts AuditArtifact[]
+  ticket             QATicket            @relation(fields: [qaTicketId], references: [id], onDelete: Cascade)
+  project            Project             @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  artifacts          AuditArtifact[]
+  selfReviewVerdicts SelfReviewVerdict[]
 
   @@index([qaTicketId, attemptNumber])
   @@index([projectId, attemptedAt(sort: Desc)])
@@ -505,6 +507,11 @@ enum AttemptStatus {
   REJECTED
   REGRESSED_REVERTED
   FAILED
+  // QAP-133 (Sprint 13 Phase 9). Set by the orchestrator when the recursive
+  // self-reviewer returns 'fail' or 'manual_review_required'. Blocks dispatch
+  // until an operator overrides via the orchestrate route's ?force=true flag
+  // (which auditably writes a synthetic SelfReviewVerdict 'pass' row).
+  MANUAL_REVIEW_REQUIRED
 
   @@schema("derwin")
 }
@@ -1171,3 +1178,47 @@ model MilestoneEvent {
   @@map("milestone_events")
   @@schema("derwin")
 }
+
+// ═══════════════════════════════════════════════════════════════════════════
+// QAP-133 (Sprint 13 Phase 9) — Recursive self-review verdict audit trail.
+//
+// Pre-merge gate: the recursive self-reviewer (Anthropic-backed adapter
+// reviewing Claude's own diff) emits one verdict row per call. The
+// orchestrator persists every call's verdict regardless of outcome — the
+// audit trail is non-negotiable. The orchestrate route's `?force=true`
+// override path also writes here with verdict='pass' and reasonHints
+// capturing the operator's userId so every override is auditable.
+//
+// Tenant scope: every read/write filters by projectId (Pattern D). The
+// (projectId, classification, surface) compound index supports cohort
+// queries surfaced on the dashboard. The (projectId, createdAt desc)
+// index supports the recent-verdicts pane.
+//
+// The Prisma-backed implementation lives at
+// packages/db/src/self-review-verdict-store.ts; the SDK contract is in
+// @derwinjs/sdk (SelfReviewVerdictStore in
+// packages/sdk/src/types/self-review-verdict-store.ts).
+
+model SelfReviewVerdict {
+  id                  String   @id @default(cuid())
+  projectId           String
+  qaFixAttemptId      String
+  qaTicketId          String
+  classification      String // mirrored from QATicket for cohort analysis
+  surface             String // mirrored from QATicket for cohort analysis
+  verdict             String // 'pass' | 'fail' | 'manual_review_required'
+  reasonHints         String[] // pgsql native array; reasonHints from the SDK
+  criticalIssuesFound Int
+  minorIssuesFound    Int
+  createdAt           DateTime @default(now())
+
+  project      Project      @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  qaFixAttempt QAFixAttempt @relation(fields: [qaFixAttemptId], references: [id], onDelete: Cascade)
+
+  @@index([projectId])
+  @@index([qaFixAttemptId])
+  @@index([projectId, classification, surface]) // cohort queries
+  @@index([projectId, createdAt(sort: Desc)]) // recent verdicts
+  @@map("self_review_verdicts")
+  @@schema("derwin")
+}