@geraldmaron/construct 1.4.1 → 1.5.0

package/lib/orchestration/run-store-postgres.mjs

@@ -1,51 +1,57 @@
 /**
- * lib/orchestration/run-store-postgres.mjs — Postgres-backed run store (Mode-C).
+ * lib/orchestration/run-store-postgres.mjs — optional Postgres run-store.
  *
- * Mirrors lib/intake/postgres-queue.mjs: a class taking the tagged-template `sql`
- * client from createSqlClient(env) (porsager/postgres style) and a project key.
- * Orchestration runs persist to `construct_orchestration_runs`; triage-like
- * columns (status, execution_mode) are flattened for filtering while the full run
- * round-trips in `payload jsonb`. Multi-project isolation comes from the
- * (run_id, project) composite primary key.
+ * Not "the backend". Substrate owns the queue/run-store CONTRACT;
+ * git-queue is the zero-dependency DEFAULT provider. Postgres is an OPTIONAL
+ * kind:'queue' provider (ADR-0052 manifest taxonomy) that an operator selects
+ * explicitly for intake queues. This class is the run-store side of the same
+ * optional Postgres substrate and is consumed by lib/orchestration/store.mjs
+ * when orchestration.store resolves to a reachable Postgres SQL client.
  *
- * Scope: the STORE is the deliverable. Container-worker spawning (Mode-C's
- * optional worker topology) is out of scope (ADR-0021); a Postgres run store lets
- * a team/enterprise deployment share durable runs across processes today.
+ * Shape: a class taking the tagged-template `sql` client from
+ * createSqlClient(env) (porsager/postgres style), a project key, and a tenant
+ * id. Orchestration runs persist to `construct_orchestration_runs`;
+ * triage-like columns (status, execution_mode) are flattened for filtering
+ * while the full run round-trips in `payload jsonb`. Project isolation comes
+ * from the (run_id, project) composite primary key; tenant scoping (LMCP-H4,
+ * ADR-0057/A7 stage 1) is a queryable `tenant_id` column filtered on every
+ * read — the same project's runs stay row-partitioned by tenant rather than
+ * pooled. tenant_id is deliberately NOT part of the primary key: run_id is
+ * already globally unique (randomUUID-derived), and folding tenant_id into
+ * the key would force a destructive constraint migration for a partition
+ * dimension a plain filtered index already serves. Stage 2 — physical
+ * per-tenant isolation (separate schemas/databases) and per-tenant
+ * encryption — is explicitly deferred and not advertised; this table remains
+ * a single shared relation with row-level tenant scoping only. Container-
+ * worker spawning is out of scope (ADR-0021).
  */
 
 export class PostgresRunStore {
-  constructor({ sql, project } = {}) {
+  constructor({ sql, project, tenantId = 'local' } = {}) {
     if (!sql) throw new Error('PostgresRunStore: sql client is required');
     if (!project) throw new Error('PostgresRunStore: project is required');
     this.sql = sql;
     this.project = project;
+    this.tenantId = tenantId;
   }
 
   async ensureSchema() {
-    await this.sql`
-      CREATE TABLE IF NOT EXISTS construct_orchestration_runs (
-        run_id TEXT,
-        project TEXT,
-        created_at TEXT,
-        status TEXT,
-        execution_mode TEXT,
-        payload JSONB,
-        PRIMARY KEY (run_id, project)
-      )
-    `;
+    const { applyMigrations } = await import('../db/migrate.mjs');
+    await applyMigrations(this.sql);
   }
 
   async saveRun(run) {
     if (!run?.runId) throw new Error('saveRun: run.runId is required');
     await this.sql`
       INSERT INTO construct_orchestration_runs (
-        run_id, project, created_at, status, execution_mode, payload
+        run_id, project, tenant_id, created_at, status, execution_mode, payload
       ) VALUES (
-        ${run.runId}, ${this.project}, ${run.createdAt || null},
+        ${run.runId}, ${this.project}, ${this.tenantId}, ${run.createdAt || null},
         ${run.status || null}, ${run.execution?.executionMode || null},
         ${this.sql.json(run)}
       )
       ON CONFLICT (run_id, project) DO UPDATE SET
+        tenant_id = EXCLUDED.tenant_id,
         created_at = EXCLUDED.created_at,
         status = EXCLUDED.status,
         execution_mode = EXCLUDED.execution_mode,
@@ -58,7 +64,7 @@ export class PostgresRunStore {
     if (!runId) return null;
     const rows = await this.sql`
       SELECT payload FROM construct_orchestration_runs
-      WHERE run_id = ${runId} AND project = ${this.project}
+      WHERE run_id = ${runId} AND project = ${this.project} AND tenant_id = ${this.tenantId}
       LIMIT 1
     `;
     return rows[0]?.payload || null;
@@ -67,7 +73,7 @@ export class PostgresRunStore {
   async listRuns({ limit = 20 } = {}) {
     const rows = await this.sql`
       SELECT payload FROM construct_orchestration_runs
-      WHERE project = ${this.project}
+      WHERE project = ${this.project} AND tenant_id = ${this.tenantId}
       ORDER BY created_at DESC
       LIMIT ${limit}
     `;

package/lib/orchestration/run-store-sqlite.mjs

@@ -2,9 +2,9 @@
  * lib/orchestration/run-store-sqlite.mjs — SQLite-backed run store (Mode-B).
  *
  * Same saveRun/loadRun/listRuns surface as the filesystem store (run-store.mjs),
- * backed by a single `node:sqlite` database under
- * `.cx/runtime/orchestration/runs.db`. A daemon-grade local store: durable,
- * single-file, queryable, with no Postgres/Docker dependency.
+ * backed by a single `node:sqlite` database under the project's machine-scoped
+ * `<stateRoot>/runtime/orchestration/runs.db` (ADR-0066). A daemon-grade local
+ * store: durable, single-file, queryable, with no Postgres/Docker dependency.
  *
  * Node compatibility boundary: `node:sqlite` exists only on Node >=22.5, but the
  * CI matrix also runs Node 20. So the import is LAZY (inside a function, never at
@@ -14,12 +14,12 @@
  * the default test path statically imports node:sqlite.
  */
 
-import { mkdirSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { createRequire } from 'node:module';
 
+import { resolveStateDir } from '../state-root.mjs';
+
 const require = createRequire(import.meta.url);
-const RUNTIME_REL = join('.cx', 'runtime', 'orchestration');
 
 let cachedDatabaseSync;
 
@@ -41,14 +41,8 @@ export function sqliteAvailable() {
   return loadDatabaseSync() != null;
 }
 
-function projectRoot(cwd) {
-  return isAbsolute(cwd) ? cwd : resolve(cwd);
-}
-
 function dbPath(cwd) {
-  const dir = join(projectRoot(cwd), RUNTIME_REL);
-  mkdirSync(dir, { recursive: true });
-  return join(dir, 'runs.db');
+  return join(resolveStateDir(cwd, 'runtime', 'orchestration'), 'runs.db');
 }
 
 function openDb(cwd) {
@@ -56,7 +50,7 @@ function openDb(cwd) {
   if (!DatabaseSync) {
     const err = new Error('SQLite run store requires Node >=22.5 (node:sqlite is unavailable on this runtime).');
     err.code = 'SQLITE_UNAVAILABLE';
-    err.remediation = 'Upgrade to Node >=22.5, or set orchestration.store to "filesystem" / "postgres".';
+    err.remediation = 'Upgrade to Node >=22.5, or set orchestration.store to "filesystem".';
     throw err;
   }
   const db = new DatabaseSync(dbPath(cwd));

package/lib/orchestration/run-store.mjs

@@ -3,27 +3,28 @@
  * orchestration runtime (Mode-A, zero-dependency).
  *
  * Orchestration runs and their task lifecycle live as JSON under the project's
- * `.cx/runtime/orchestration/runs/`, so a run survives editor/host restarts and
- * is inspectable without a daemon, a database, or Docker. Writes are atomic
- * (temp file then rename) so a crash mid-write cannot leave a half-written run;
- * reads tolerate a corrupt file by skipping it rather than throwing. This is the
- * Mode-A backend; Mode-B/C (SQLite/Postgres) would implement the same load/save
- * surface without changing callers.
+ * machine-scoped `<stateRoot>/runtime/orchestration/runs/` (ADR-0066), so a run
+ * survives editor/host restarts and is inspectable without a daemon, a
+ * database, or Docker. Writes are atomic (temp file then rename) so a crash
+ * mid-write cannot leave a half-written run; reads tolerate a corrupt file by
+ * skipping it rather than throwing. This is the Mode-A backend; Mode-B/C
+ * (SQLite/Postgres) would implement the same load/save surface without
+ * changing callers.
  */
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { join } from 'node:path';
 
-const RUNTIME_REL = join('.cx', 'runtime', 'orchestration');
+import { resolveStateDir } from '../state-root.mjs';
 
 let writeCounter = 0;
 
-function projectRoot(cwd) {
-  return isAbsolute(cwd) ? cwd : resolve(cwd);
-}
+// ensureDir:false — runtimeDir() backs both reads (loadRun/listRuns, which
+// must not conjure a directory for a project that has never run anything)
+// and writes (saveRun, which already mkdirs before it writes).
 
 export function runtimeDir(cwd = process.cwd()) {
-  return join(projectRoot(cwd), RUNTIME_REL);
+  return resolveStateDir(cwd, 'runtime', 'orchestration', { ensureDir: false });
 }
 
 function runsDir(cwd) {
@@ -78,5 +79,17 @@ export function listRuns(cwd, { limit = 20 } = {}) {
     executionMode: run.execution?.executionMode || null,
     createdAt: run.createdAt,
     request: run.request?.summary || null,
+    // Include fields needed for shapeRun to compute prepareOnly and degraded
+    tasks: run.tasks || [],
+    degraded: run.degraded ?? run.execution?.degraded ?? false,
+    degradationReason: run.degradationReason ?? run.execution?.degradationReason ?? null,
+    semantics: run.semantics ?? null,
+    plan: run.plan ? {
+      intent: run.plan.intent ?? null,
+      track: run.plan.track ?? null,
+      suggestedWorkflowType: run.plan.suggestedWorkflowType ?? null,
+      researchExecutionPolicy: run.plan.researchExecutionPolicy ?? null,
+      specialists: run.plan.specialists ?? [],
+    } : null,
   }));
 }