@hasna/infinity 0.1.0

package/migrations/0001_authority.sql

@@ -0,0 +1,689 @@
+CREATE SCHEMA IF NOT EXISTS infinity;
+
+CREATE TABLE infinity.authority_epochs (
+  authority_epoch bigint PRIMARY KEY CHECK (authority_epoch > 0),
+  state text NOT NULL CHECK (state IN ('recovery_pending', 'reconciled', 'unknown_requires_review')),
+  activation_receipt_digest text NOT NULL CHECK (activation_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  activated_at timestamptz NOT NULL,
+  is_current boolean NOT NULL DEFAULT false
+);
+CREATE UNIQUE INDEX authority_epochs_one_current ON infinity.authority_epochs ((is_current)) WHERE is_current;
+
+CREATE TABLE infinity.authority_runtime_meta (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  next_queue_sequence bigint NOT NULL CHECK (next_queue_sequence > 0),
+  next_commit_sequence bigint NOT NULL CHECK (next_commit_sequence > 0),
+  journal_acknowledged_through bigint NOT NULL CHECK (journal_acknowledged_through >= 0),
+  budget_limit_units bigint NOT NULL CHECK (budget_limit_units >= 0),
+  budget_reserved_units bigint NOT NULL CHECK (budget_reserved_units >= 0),
+  budget_charged_units bigint NOT NULL CHECK (budget_charged_units >= 0),
+  budget_released_units bigint NOT NULL CHECK (budget_released_units >= 0)
+);
+
+CREATE TABLE infinity.authority_mutation_change_buffer (
+  change_id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  commit_sequence bigint NOT NULL CHECK (commit_sequence > 0),
+  table_name text NOT NULL CHECK (table_name ~ '^[a-z][a-z0-9_]*$'),
+  mutation_kind text NOT NULL CHECK (mutation_kind IN ('INSERT','UPDATE','DELETE')),
+  row_record jsonb NOT NULL,
+  captured_at timestamptz NOT NULL
+);
+CREATE INDEX authority_mutation_change_sequence ON infinity.authority_mutation_change_buffer (commit_sequence, change_id);
+
+CREATE TABLE infinity.authority_mutation_envelopes (
+  commit_sequence bigint PRIMARY KEY CHECK (commit_sequence > 0),
+  operation_id text NOT NULL UNIQUE,
+  operation_digest text NOT NULL CHECK (operation_digest ~ '^sha256:[0-9a-f]{64}$'),
+  envelope_digest text NOT NULL UNIQUE CHECK (envelope_digest ~ '^sha256:[0-9a-f]{64}$'),
+  envelope_record jsonb NOT NULL,
+  created_at timestamptz NOT NULL
+);
+
+CREATE TABLE infinity.authority_mutation_acknowledgements (
+  commit_sequence bigint PRIMARY KEY REFERENCES infinity.authority_mutation_envelopes(commit_sequence),
+  frontier_digest text NOT NULL UNIQUE CHECK (frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  acknowledgement_digest text NOT NULL UNIQUE CHECK (acknowledgement_digest ~ '^sha256:[0-9a-f]{64}$'),
+  restore_domain_id text NOT NULL CHECK (restore_domain_id ~ '^[A-Za-z0-9][A-Za-z0-9:_-]{0,95}$'),
+  signer_principal text NOT NULL CHECK (signer_principal ~ '^[A-Za-z0-9][A-Za-z0-9:_-]{0,95}$'),
+  signing_key_id text NOT NULL CHECK (signing_key_id ~ '^[A-Za-z0-9][A-Za-z0-9:_-]{0,95}$'),
+  signature text NOT NULL CHECK (signature ~ '^[A-Za-z0-9_-]{80,128}$'),
+  acknowledgement_record jsonb NOT NULL,
+  acknowledged_at timestamptz NOT NULL
+);
+
+ALTER TABLE infinity.authority_mutation_change_buffer
+  ADD CONSTRAINT authority_mutation_change_envelope_fk
+  FOREIGN KEY (commit_sequence) REFERENCES infinity.authority_mutation_envelopes(commit_sequence)
+  DEFERRABLE INITIALLY DEFERRED;
+
+CREATE TABLE infinity.routes (
+  route_lineage_id text PRIMARY KEY,
+  route_id text NOT NULL,
+  route_epoch bigint NOT NULL CHECK (route_epoch > 0),
+  state text NOT NULL CHECK (state IN ('active','draining','inactive')),
+  UNIQUE (route_lineage_id, route_epoch),
+  UNIQUE (route_lineage_id, route_id, route_epoch)
+);
+
+CREATE TABLE infinity.run_specs (
+  id text PRIMARY KEY,
+  digest text NOT NULL UNIQUE CHECK (digest ~ '^sha256:[0-9a-f]{64}$'),
+  schema_version text NOT NULL,
+  canonical_spec jsonb NOT NULL,
+  created_at timestamptz NOT NULL,
+  UNIQUE (id, digest)
+);
+
+CREATE TABLE infinity.runs (
+  id text PRIMARY KEY,
+  run_spec_id text NOT NULL REFERENCES infinity.run_specs(id),
+  run_spec_digest text NOT NULL CHECK (run_spec_digest ~ '^sha256:[0-9a-f]{64}$'),
+  route_lineage_id text NOT NULL,
+  route_id text NOT NULL,
+  route_epoch bigint NOT NULL CHECK (route_epoch > 0),
+  admitted_authority_epoch bigint NOT NULL REFERENCES infinity.authority_epochs(authority_epoch) CHECK (admitted_authority_epoch > 0),
+  logical_work_key text NOT NULL,
+  owner_principal text NOT NULL,
+  project_id text NOT NULL,
+  repository_id text NOT NULL,
+  current_attempt_id text NOT NULL,
+  state text NOT NULL CHECK (state IN ('admitted','active','cancel_requested','finalizing','succeeded','failed','canceled','lost_uncheckpointed','discarded_uncheckpointed')),
+  terminal_outcome text,
+  revision integer NOT NULL CHECK (revision > 0),
+  next_event_sequence integer NOT NULL CHECK (next_event_sequence > 0),
+  created_at timestamptz NOT NULL,
+  updated_at timestamptz NOT NULL,
+  CHECK (updated_at >= created_at),
+  CHECK (
+    (state IN ('admitted','active','cancel_requested','finalizing') AND terminal_outcome IS NULL)
+    OR (state = 'succeeded' AND terminal_outcome = 'succeeded')
+    OR (state = 'failed' AND terminal_outcome IN ('failed_permanent','policy_denied','budget_exhausted'))
+    OR (state = 'canceled' AND terminal_outcome = 'canceled')
+    OR (state = 'lost_uncheckpointed' AND terminal_outcome = 'lost_uncheckpointed')
+    OR (state = 'discarded_uncheckpointed' AND terminal_outcome = 'discarded_uncheckpointed')
+  ),
+  FOREIGN KEY (run_spec_id, run_spec_digest) REFERENCES infinity.run_specs(id, digest),
+  FOREIGN KEY (route_lineage_id, route_id, route_epoch) REFERENCES infinity.routes(route_lineage_id, route_id, route_epoch),
+  UNIQUE (route_lineage_id, logical_work_key),
+  UNIQUE (id, route_lineage_id, logical_work_key, run_spec_digest)
+);
+
+CREATE TABLE infinity.attempts (
+  id text PRIMARY KEY,
+  run_id text NOT NULL REFERENCES infinity.runs(id) DEFERRABLE INITIALLY DEFERRED,
+  attempt_number integer NOT NULL CHECK (attempt_number > 0),
+  phase text NOT NULL CHECK (phase IN ('queued','lane_leased','sandbox_allocating','running','checkpointed','verifying','finalizing','terminal')),
+  outcome text CHECK (outcome IS NULL OR outcome IN ('succeeded','failed_retryable','failed_permanent','canceled','lost_uncheckpointed','discarded_uncheckpointed','policy_denied','budget_exhausted')),
+  pending_outcome text CHECK (pending_outcome IS NULL OR pending_outcome IN ('succeeded','failed_retryable','failed_permanent','canceled','lost_uncheckpointed','discarded_uncheckpointed','policy_denied','budget_exhausted')),
+  runner_principal text,
+  attempt_lease_id text,
+  lease_epoch bigint CHECK (lease_epoch > 0),
+  lease_holder_principal text,
+  lease_expires_at timestamptz,
+  cancellation_state text NOT NULL CHECK (cancellation_state IN ('none','requested','fenced','cleanup_pending','complete')),
+  retry_cause text,
+  terminal_reason text,
+  revision integer NOT NULL CHECK (revision > 0),
+  created_at timestamptz NOT NULL,
+  updated_at timestamptz NOT NULL,
+  UNIQUE (run_id, attempt_number),
+  UNIQUE (id, run_id),
+  CHECK (updated_at >= created_at),
+  CHECK ((attempt_lease_id IS NULL AND lease_epoch IS NULL AND lease_holder_principal IS NULL AND lease_expires_at IS NULL)
+      OR (attempt_lease_id IS NOT NULL AND lease_epoch IS NOT NULL AND lease_holder_principal IS NOT NULL AND lease_expires_at IS NOT NULL)),
+  CHECK ((attempt_lease_id IS NULL AND runner_principal IS NULL)
+      OR (attempt_lease_id IS NOT NULL AND runner_principal IS NOT NULL)),
+  CHECK (phase <> 'queued' OR attempt_lease_id IS NULL),
+  CHECK (phase IN ('queued','terminal') OR attempt_lease_id IS NOT NULL),
+  CHECK ((phase = 'terminal') = (outcome IS NOT NULL)),
+  CHECK (phase = 'finalizing' OR pending_outcome IS NULL),
+  CHECK (phase <> 'terminal' OR pending_outcome IS NULL),
+  CHECK (phase <> 'terminal' OR attempt_lease_id IS NOT NULL OR outcome = 'policy_denied')
+);
+CREATE UNIQUE INDEX attempts_one_nonterminal_per_run ON infinity.attempts (run_id) WHERE phase <> 'terminal';
+
+ALTER TABLE infinity.runs
+  ADD CONSTRAINT runs_current_attempt_fk FOREIGN KEY (current_attempt_id, id) REFERENCES infinity.attempts(id, run_id) DEFERRABLE INITIALLY DEFERRED;
+
+CREATE TABLE infinity.attempt_lease_grants (
+  attempt_lease_id text PRIMARY KEY,
+  attempt_id text NOT NULL REFERENCES infinity.attempts(id),
+  run_id text NOT NULL REFERENCES infinity.runs(id),
+  lease_epoch bigint NOT NULL CHECK (lease_epoch > 0),
+  lease_holder_principal text NOT NULL,
+  audience text NOT NULL,
+  issued_at timestamptz NOT NULL,
+  lease_expires_at timestamptz NOT NULL CHECK (lease_expires_at > issued_at),
+  grant_digest text NOT NULL CHECK (grant_digest ~ '^sha256:[0-9a-f]{64}$'),
+  kind text NOT NULL CHECK (kind IN ('worker','cancel_recovery')),
+  UNIQUE (attempt_id, lease_epoch),
+  UNIQUE (attempt_lease_id, attempt_id, lease_epoch),
+  FOREIGN KEY (attempt_id, run_id) REFERENCES infinity.attempts(id, run_id)
+);
+
+CREATE TABLE infinity.attempt_lease_events (
+  id text PRIMARY KEY,
+  attempt_lease_id text NOT NULL,
+  attempt_id text NOT NULL REFERENCES infinity.attempts(id),
+  lease_epoch bigint NOT NULL CHECK (lease_epoch > 0),
+  kind text NOT NULL CHECK (kind IN ('granted','renewed','fenced','released','expired')),
+  actor_principal text NOT NULL,
+  database_time timestamptz NOT NULL,
+  detail_digest text NOT NULL CHECK (detail_digest ~ '^sha256:[0-9a-f]{64}$'),
+  UNIQUE (attempt_id, lease_epoch, kind, database_time),
+  FOREIGN KEY (attempt_lease_id, attempt_id, lease_epoch)
+    REFERENCES infinity.attempt_lease_grants(attempt_lease_id, attempt_id, lease_epoch)
+);
+
+CREATE TABLE infinity.queue_entries (
+  attempt_id text PRIMARY KEY REFERENCES infinity.attempts(id),
+  run_id text NOT NULL REFERENCES infinity.runs(id),
+  project_id text NOT NULL,
+  lane_pool_id text NOT NULL,
+  enqueue_sequence bigint NOT NULL UNIQUE CHECK (enqueue_sequence > 0),
+  admitted_at timestamptz NOT NULL,
+  state text NOT NULL CHECK (state IN ('queued','reserved','removed')),
+  FOREIGN KEY (attempt_id, run_id) REFERENCES infinity.attempts(id, run_id)
+);
+
+CREATE TABLE infinity.budget_reservations (
+  run_id text PRIMARY KEY REFERENCES infinity.runs(id),
+  ceiling_units bigint NOT NULL CHECK (ceiling_units >= 0),
+  charged_units bigint NOT NULL CHECK (charged_units >= 0),
+  state text NOT NULL CHECK (state IN ('reserved','settled','released')),
+  CHECK (charged_units <= ceiling_units)
+);
+
+CREATE TABLE infinity.admission_keys (
+  route_lineage_id text NOT NULL,
+  logical_work_key text NOT NULL,
+  run_spec_digest text NOT NULL CHECK (run_spec_digest ~ '^sha256:[0-9a-f]{64}$'),
+  run_id text NOT NULL REFERENCES infinity.runs(id),
+  disposition text NOT NULL CHECK (disposition IN ('admitted','tombstone')),
+  created_at timestamptz NOT NULL,
+  PRIMARY KEY (route_lineage_id, logical_work_key),
+  FOREIGN KEY (run_id, route_lineage_id, logical_work_key, run_spec_digest)
+    REFERENCES infinity.runs(id, route_lineage_id, logical_work_key, run_spec_digest)
+);
+
+CREATE TABLE infinity.idempotency_records (
+  operation_id text PRIMARY KEY,
+  actor_principal text NOT NULL,
+  command text NOT NULL,
+  scope text NOT NULL,
+  idempotency_key text NOT NULL,
+  request_hash text NOT NULL CHECK (request_hash ~ '^sha256:[0-9a-f]{64}$'),
+  source_namespace text NOT NULL,
+  request_execution_epoch bigint NOT NULL CHECK (request_execution_epoch > 0),
+  request_execution_holder text NOT NULL,
+  request_execution_expires_at timestamptz NOT NULL,
+  state text NOT NULL CHECK (state IN ('in_flight','committed','aborted')),
+  result jsonb,
+  created_at timestamptz NOT NULL,
+  updated_at timestamptz NOT NULL,
+  UNIQUE (actor_principal, command, scope, idempotency_key)
+);
+
+ALTER TABLE infinity.authority_mutation_envelopes
+  ADD CONSTRAINT authority_mutation_envelope_operation_fk
+  FOREIGN KEY (operation_id) REFERENCES infinity.idempotency_records(operation_id)
+  DEFERRABLE INITIALLY DEFERRED;
+
+CREATE TABLE infinity.event_stream_heads (
+  aggregate_type text NOT NULL,
+  aggregate_id text NOT NULL,
+  sequence integer NOT NULL CHECK (sequence > 0),
+  digest text NOT NULL CHECK (digest ~ '^sha256:[0-9a-f]{64}$'),
+  PRIMARY KEY (aggregate_type, aggregate_id)
+);
+
+CREATE TABLE infinity.events (
+  event_id text PRIMARY KEY,
+  authority_commit_sequence bigint NOT NULL UNIQUE CHECK (authority_commit_sequence > 0),
+  operation_id text NOT NULL,
+  operation_digest text NOT NULL CHECK (operation_digest ~ '^sha256:[0-9a-f]{64}$'),
+  aggregate_type text NOT NULL,
+  aggregate_id text NOT NULL,
+  aggregate_sequence integer NOT NULL CHECK (aggregate_sequence > 0),
+  run_id text,
+  run_sequence integer,
+  actor_principal text NOT NULL,
+  authority_epoch bigint NOT NULL CHECK (authority_epoch > 0),
+  route_lineage_id text,
+  route_id text,
+  route_epoch bigint CHECK (route_epoch > 0),
+  attempt_id text,
+  attempt_lease_id text,
+  lease_epoch bigint CHECK (lease_epoch > 0),
+  lease_holder_principal text,
+  audience text,
+  resource_lease_id text,
+  resource_id text,
+  resource_lifecycle_generation bigint CHECK (resource_lifecycle_generation > 0),
+  operation_executor_principal text,
+  event_schema text NOT NULL,
+  event_type text NOT NULL,
+  event_digest text NOT NULL UNIQUE CHECK (event_digest ~ '^sha256:[0-9a-f]{64}$'),
+  prior_event_digest text CHECK (prior_event_digest IS NULL OR prior_event_digest ~ '^sha256:[0-9a-f]{64}$'),
+  payload jsonb NOT NULL,
+  payload_digest text NOT NULL CHECK (payload_digest ~ '^sha256:[0-9a-f]{64}$'),
+  event_record jsonb NOT NULL,
+  database_time timestamptz NOT NULL,
+  UNIQUE (aggregate_type, aggregate_id, aggregate_sequence),
+  UNIQUE (run_id, run_sequence),
+  UNIQUE (event_id, authority_commit_sequence, event_digest),
+  CHECK ((route_lineage_id IS NULL AND route_id IS NULL AND route_epoch IS NULL)
+      OR (route_lineage_id IS NOT NULL AND route_id IS NOT NULL AND route_epoch IS NOT NULL)),
+  CHECK ((attempt_lease_id IS NULL AND lease_epoch IS NULL AND lease_holder_principal IS NULL AND audience IS NULL)
+      OR (attempt_lease_id IS NOT NULL AND lease_epoch IS NOT NULL AND lease_holder_principal IS NOT NULL AND audience IS NOT NULL)),
+  CHECK ((resource_lease_id IS NULL AND resource_id IS NULL AND resource_lifecycle_generation IS NULL)
+      OR (resource_lease_id IS NOT NULL AND resource_id IS NOT NULL AND resource_lifecycle_generation IS NOT NULL))
+);
+
+CREATE TABLE infinity.outbox (
+  id text PRIMARY KEY,
+  event_id text NOT NULL REFERENCES infinity.events(event_id),
+  destination text NOT NULL,
+  projection_version text NOT NULL,
+  outbox_identity_digest text NOT NULL UNIQUE CHECK (outbox_identity_digest ~ '^sha256:[0-9a-f]{64}$'),
+  payload_digest text NOT NULL CHECK (payload_digest ~ '^sha256:[0-9a-f]{64}$'),
+  state text NOT NULL CHECK (state IN ('held','pending','leased','delivered','blocked')),
+  authority_commit_sequence bigint NOT NULL CHECK (authority_commit_sequence > 0),
+  lease_owner text,
+  lease_expires_at timestamptz,
+  created_at timestamptz NOT NULL,
+  CHECK ((lease_owner IS NULL) = (lease_expires_at IS NULL)),
+  UNIQUE (event_id, destination, projection_version),
+  FOREIGN KEY (event_id, authority_commit_sequence, payload_digest)
+    REFERENCES infinity.events(event_id, authority_commit_sequence, event_digest)
+);
+
+CREATE TABLE infinity.external_operations (
+  id text NOT NULL,
+  operation_step_id text NOT NULL,
+  operation_execution_epoch bigint NOT NULL CHECK (operation_execution_epoch > 0),
+  provider_idempotency_token text NOT NULL,
+  state text NOT NULL CHECK (state IN ('planned','intent_committed','prepared','dispatched','succeeded','failed_effect','failed_no_effect','unknown','suppressed','quarantined')),
+  fence_digest text NOT NULL CHECK (fence_digest ~ '^sha256:[0-9a-f]{64}$'),
+  operation_record jsonb NOT NULL,
+  revision integer NOT NULL CHECK (revision > 0),
+  updated_at timestamptz NOT NULL,
+  PRIMARY KEY (id, operation_execution_epoch)
+);
+
+CREATE TABLE infinity.effect_operation_steps (
+  operation_id text NOT NULL,
+  operation_step_id text NOT NULL,
+  step_ordinal integer NOT NULL CHECK (step_ordinal > 0),
+  operation_step_digest text NOT NULL CHECK (operation_step_digest ~ '^sha256:[0-9a-f]{64}$'),
+  step_record jsonb NOT NULL,
+  PRIMARY KEY (operation_id, operation_step_id),
+  UNIQUE (operation_id, step_ordinal)
+);
+
+CREATE TABLE infinity.effect_journal_records (
+  operation_id text NOT NULL,
+  operation_step_id text NOT NULL,
+  operation_execution_epoch bigint NOT NULL CHECK (operation_execution_epoch > 0),
+  record_kind text NOT NULL CHECK (record_kind IN ('DISPATCHED','OUTCOME')),
+  outcome_kind text CHECK (outcome_kind IS NULL OR outcome_kind IN ('succeeded','failed_effect','failed_no_effect','reconciliation_blocked')),
+  outcome_receipt_digest text CHECK (outcome_receipt_digest IS NULL OR outcome_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  operation_digest text NOT NULL CHECK (operation_digest ~ '^sha256:[0-9a-f]{64}$'),
+  operation_step_digest text NOT NULL CHECK (operation_step_digest ~ '^sha256:[0-9a-f]{64}$'),
+  request_digest text NOT NULL CHECK (request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  target_digest text NOT NULL CHECK (target_digest ~ '^sha256:[0-9a-f]{64}$'),
+  resource_id text NOT NULL,
+  resource_lifecycle_generation bigint NOT NULL CHECK (resource_lifecycle_generation > 0),
+  predecessor_receipt_digest text CHECK (predecessor_receipt_digest IS NULL OR predecessor_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  provider_idempotency_token text NOT NULL,
+  journal_sequence bigint NOT NULL UNIQUE CHECK (journal_sequence > 0),
+  prior_frontier_digest text CHECK (prior_frontier_digest IS NULL OR prior_frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  record_digest text NOT NULL CHECK (record_digest ~ '^sha256:[0-9a-f]{64}$'),
+  frontier_digest text NOT NULL UNIQUE CHECK (frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  signer_principal text NOT NULL,
+  signing_key_id text NOT NULL,
+  signature text NOT NULL,
+  anchor_record jsonb NOT NULL,
+  created_at timestamptz NOT NULL,
+  PRIMARY KEY (operation_id, operation_step_id, operation_execution_epoch, record_kind),
+  FOREIGN KEY (operation_id, operation_step_id) REFERENCES infinity.effect_operation_steps(operation_id, operation_step_id),
+  CHECK ((record_kind = 'DISPATCHED' AND outcome_kind IS NULL AND outcome_receipt_digest IS NULL)
+      OR (record_kind = 'OUTCOME' AND outcome_kind IS NOT NULL AND outcome_receipt_digest IS NOT NULL))
+);
+
+CREATE TABLE infinity.effect_journal_frontier (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  journal_sequence bigint NOT NULL CHECK (journal_sequence >= 0),
+  frontier_digest text CHECK (frontier_digest IS NULL OR frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  updated_at timestamptz NOT NULL,
+  CHECK ((journal_sequence = 0) = (frontier_digest IS NULL))
+);
+
+CREATE OR REPLACE FUNCTION infinity.reject_immutable_mutation() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'immutable Infinity record cannot be updated or deleted' USING ERRCODE = '55000';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.capture_authority_mutation_change() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog, infinity AS $$
+DECLARE
+  sequence_text text;
+  image jsonb;
+BEGIN
+  IF TG_TABLE_NAME = 'authority_runtime_meta' AND TG_OP = 'UPDATE'
+    AND (to_jsonb(NEW) - 'journal_acknowledged_through') = (to_jsonb(OLD) - 'journal_acknowledged_through') THEN
+    RETURN NEW;
+  END IF;
+  sequence_text := NULLIF(current_setting('infinity.authority_commit_sequence', true), '');
+  IF sequence_text IS NULL OR sequence_text !~ '^[1-9][0-9]*$' THEN
+    RAISE EXCEPTION 'authority mutation lacks a committed sequence context' USING ERRCODE = '55000';
+  END IF;
+  IF TG_OP = 'DELETE' THEN image := to_jsonb(OLD); ELSE image := to_jsonb(NEW); END IF;
+  INSERT INTO infinity.authority_mutation_change_buffer
+    (commit_sequence, table_name, mutation_kind, row_record, captured_at)
+  VALUES (sequence_text::bigint, TG_TABLE_NAME, TG_OP, image, clock_timestamp());
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_authority_mutation_envelope() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog, infinity AS $$
+DECLARE
+  mismatch boolean;
+BEGIN
+  IF NEW.envelope_record->>'schema_version' IS DISTINCT FROM 'infinity.authority-mutation-reconstruction/v1'
+    OR (NEW.envelope_record->>'commit_sequence')::bigint IS DISTINCT FROM NEW.commit_sequence
+    OR NEW.envelope_record->>'operation_id' IS DISTINCT FROM NEW.operation_id
+    OR NEW.envelope_record->>'operation_digest' IS DISTINCT FROM NEW.operation_digest
+    OR jsonb_typeof(NEW.envelope_record->'changes') IS DISTINCT FROM 'array' THEN
+    RAISE EXCEPTION 'authority mutation envelope columns differ from reconstruction record' USING ERRCODE = '23514';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM infinity.authority_runtime_meta
+    WHERE singleton
+      AND next_commit_sequence = NEW.commit_sequence + 1
+      AND journal_acknowledged_through = NEW.commit_sequence - 1
+  ) THEN
+    RAISE EXCEPTION 'authority mutation envelope does not extend the local contiguous frontier' USING ERRCODE = '23514';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM infinity.idempotency_records
+    WHERE operation_id = NEW.operation_id AND request_hash = NEW.operation_digest AND state = 'committed'
+  ) THEN
+    RAISE EXCEPTION 'authority mutation envelope lacks its committed idempotency record' USING ERRCODE = '23514';
+  END IF;
+  WITH buffered AS (
+    SELECT row_number() OVER (ORDER BY change_id) AS ordinal, table_name, mutation_kind, row_record
+    FROM infinity.authority_mutation_change_buffer WHERE commit_sequence = NEW.commit_sequence
+  ), encoded AS (
+    SELECT ordinality AS ordinal, value
+    FROM jsonb_array_elements(NEW.envelope_record->'changes') WITH ORDINALITY AS item(value, ordinality)
+  )
+  SELECT EXISTS (
+    SELECT 1 FROM buffered FULL JOIN encoded USING (ordinal)
+    WHERE buffered.ordinal IS NULL OR encoded.ordinal IS NULL
+      OR (encoded.value->>'change_ordinal')::bigint IS DISTINCT FROM buffered.ordinal
+      OR encoded.value->>'table_name' IS DISTINCT FROM buffered.table_name
+      OR encoded.value->>'mutation_kind' IS DISTINCT FROM buffered.mutation_kind
+      OR encoded.value->'row' IS DISTINCT FROM buffered.row_record
+  ) INTO mismatch;
+  IF mismatch OR NOT EXISTS (
+    SELECT 1 FROM infinity.authority_mutation_change_buffer WHERE commit_sequence = NEW.commit_sequence
+  ) THEN
+    RAISE EXCEPTION 'authority mutation envelope changes differ from captured row images' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_authority_mutation_acknowledgement() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog, infinity AS $$
+BEGIN
+  IF NEW.acknowledgement_record->>'ack_schema_version' IS DISTINCT FROM 'infinity.authority-mutation-journal-ack/v1'
+    OR (NEW.acknowledgement_record->>'acknowledged_through')::bigint IS DISTINCT FROM NEW.commit_sequence
+    OR NEW.acknowledgement_record->>'frontier_digest' IS DISTINCT FROM NEW.frontier_digest
+    OR NEW.acknowledgement_record->>'restore_domain_id' IS DISTINCT FROM NEW.restore_domain_id
+    OR NEW.acknowledgement_record->'encrypted_at_rest' IS DISTINCT FROM 'true'::jsonb THEN
+    RAISE EXCEPTION 'authority mutation acknowledgement columns differ from signed record' USING ERRCODE = '23514';
+  END IF;
+  IF NEW.acknowledgement_record->>'signer_principal' IS DISTINCT FROM NEW.signer_principal
+    OR NEW.acknowledgement_record->>'signing_key_id' IS DISTINCT FROM NEW.signing_key_id
+    OR NEW.acknowledgement_record->>'signature' IS DISTINCT FROM NEW.signature THEN
+    RAISE EXCEPTION 'authority mutation acknowledgement columns differ from signed record' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_authority_ack_frontier_update() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog, infinity AS $$
+BEGIN
+  IF NEW.journal_acknowledged_through = OLD.journal_acknowledged_through THEN
+    RETURN NEW;
+  END IF;
+  IF (to_jsonb(NEW) - 'journal_acknowledged_through') IS DISTINCT FROM (to_jsonb(OLD) - 'journal_acknowledged_through')
+    OR NEW.journal_acknowledged_through <> OLD.journal_acknowledged_through + 1
+    OR NEW.journal_acknowledged_through >= NEW.next_commit_sequence
+    OR NOT EXISTS (
+      SELECT 1 FROM infinity.authority_mutation_acknowledgements
+      WHERE commit_sequence = NEW.journal_acknowledged_through
+        AND (acknowledgement_record->>'acknowledged_through')::bigint = NEW.journal_acknowledged_through
+        AND acknowledgement_record->>'frontier_digest' = frontier_digest
+    ) THEN
+    RAISE EXCEPTION 'authority mutation acknowledgement frontier update lacks the exact next signed record' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_outbox_write() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog, infinity AS $$
+DECLARE
+  acknowledged bigint;
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    IF NEW.state <> 'held' OR NEW.lease_owner IS NOT NULL OR NEW.lease_expires_at IS NOT NULL THEN
+      RAISE EXCEPTION 'new outbox records must begin held behind the journal barrier' USING ERRCODE = '23514';
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF (to_jsonb(NEW) - 'state' - 'lease_owner' - 'lease_expires_at')
+      IS DISTINCT FROM (to_jsonb(OLD) - 'state' - 'lease_owner' - 'lease_expires_at') THEN
+    RAISE EXCEPTION 'immutable outbox authority binding cannot change' USING ERRCODE = '23514';
+  END IF;
+  IF NEW.state <> 'held' THEN
+    SELECT journal_acknowledged_through INTO acknowledged
+    FROM infinity.authority_runtime_meta WHERE singleton;
+    IF acknowledged IS NULL OR acknowledged < NEW.authority_commit_sequence THEN
+      RAISE EXCEPTION 'outbox record cannot cross an unacknowledged authority frontier' USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  IF OLD.state = 'held' AND NEW.state = 'pending'
+      AND NEW.lease_owner IS NULL AND NEW.lease_expires_at IS NULL THEN
+    RETURN NEW;
+  ELSIF OLD.state = 'pending' AND NEW.state = 'leased'
+      AND OLD.lease_owner IS NULL AND OLD.lease_expires_at IS NULL
+      AND NEW.lease_owner IS NOT NULL AND NEW.lease_expires_at > clock_timestamp() THEN
+    RETURN NEW;
+  ELSIF OLD.state = 'leased' AND NEW.state = 'leased'
+      AND OLD.lease_expires_at <= clock_timestamp()
+      AND NEW.lease_owner IS NOT NULL AND NEW.lease_expires_at > clock_timestamp() THEN
+    RETURN NEW;
+  ELSIF OLD.state = 'leased' AND NEW.state = 'delivered'
+      AND OLD.lease_expires_at > clock_timestamp()
+      AND NEW.lease_owner IS NULL AND NEW.lease_expires_at IS NULL THEN
+    RETURN NEW;
+  ELSIF OLD.state = 'leased' AND NEW.state = 'pending'
+      AND OLD.lease_expires_at <= clock_timestamp()
+      AND NEW.lease_owner IS NULL AND NEW.lease_expires_at IS NULL THEN
+    RETURN NEW;
+  ELSIF OLD.state IN ('pending', 'leased') AND NEW.state = 'blocked'
+      AND NEW.lease_owner IS NULL AND NEW.lease_expires_at IS NULL THEN
+    RETURN NEW;
+  END IF;
+  RAISE EXCEPTION 'invalid outbox state or lease transition' USING ERRCODE = '23514';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_effect_journal_insert() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  current_sequence bigint;
+  current_digest text;
+  dispatched infinity.effect_journal_records%ROWTYPE;
+  prior_outcome infinity.effect_journal_records%ROWTYPE;
+BEGIN
+  SELECT journal_sequence, frontier_digest INTO current_sequence, current_digest
+  FROM infinity.effect_journal_frontier WHERE singleton FOR UPDATE;
+  IF NEW.journal_sequence <> current_sequence + 1 OR NEW.prior_frontier_digest IS DISTINCT FROM current_digest THEN
+    RAISE EXCEPTION 'effect journal record does not extend contiguous frontier' USING ERRCODE = '23514';
+  END IF;
+  IF NEW.anchor_record->>'record_digest' IS DISTINCT FROM NEW.record_digest
+    OR NEW.anchor_record->>'frontier_digest' IS DISTINCT FROM NEW.frontier_digest
+    OR NEW.anchor_record->>'signer_principal' IS DISTINCT FROM NEW.signer_principal
+    OR NEW.anchor_record->>'signing_key_id' IS DISTINCT FROM NEW.signing_key_id
+    OR NEW.anchor_record->'record'->>'operation_id' IS DISTINCT FROM NEW.operation_id
+    OR NEW.anchor_record->'record'->>'operation_step_id' IS DISTINCT FROM NEW.operation_step_id
+    OR (NEW.anchor_record->'record'->>'operation_execution_epoch')::bigint IS DISTINCT FROM NEW.operation_execution_epoch
+    OR NEW.anchor_record->'record'->>'record_kind' IS DISTINCT FROM NEW.record_kind
+    OR NEW.anchor_record->'record'->>'operation_digest' IS DISTINCT FROM NEW.operation_digest
+    OR NEW.anchor_record->'record'->>'operation_step_digest' IS DISTINCT FROM NEW.operation_step_digest
+    OR NEW.anchor_record->'record'->>'request_digest' IS DISTINCT FROM NEW.request_digest
+    OR NEW.anchor_record->'record'->>'target_digest' IS DISTINCT FROM NEW.target_digest
+    OR NEW.anchor_record->'record'->>'resource_id' IS DISTINCT FROM NEW.resource_id
+    OR (NEW.anchor_record->'record'->>'resource_lifecycle_generation')::bigint IS DISTINCT FROM NEW.resource_lifecycle_generation
+    OR NEW.anchor_record->'record'->>'predecessor_receipt_digest' IS DISTINCT FROM NEW.predecessor_receipt_digest
+    OR NEW.anchor_record->'record'->>'provider_idempotency_token' IS DISTINCT FROM NEW.provider_idempotency_token THEN
+    RAISE EXCEPTION 'effect journal columns differ from signed anchor envelope' USING ERRCODE = '23514';
+  END IF;
+  IF NEW.record_kind = 'OUTCOME' THEN
+    SELECT * INTO dispatched FROM infinity.effect_journal_records
+    WHERE operation_id = NEW.operation_id AND operation_step_id = NEW.operation_step_id
+      AND operation_execution_epoch = NEW.operation_execution_epoch AND record_kind = 'DISPATCHED';
+    IF NOT FOUND OR dispatched.anchor_record->'record'->'fence' <> NEW.anchor_record->'record'->'fence'
+      OR dispatched.operation_digest <> NEW.operation_digest
+      OR dispatched.operation_step_digest <> NEW.operation_step_digest
+      OR dispatched.request_digest <> NEW.request_digest
+      OR dispatched.target_digest <> NEW.target_digest
+      OR dispatched.resource_id <> NEW.resource_id
+      OR dispatched.resource_lifecycle_generation <> NEW.resource_lifecycle_generation
+      OR dispatched.predecessor_receipt_digest IS DISTINCT FROM NEW.predecessor_receipt_digest
+      OR dispatched.provider_idempotency_token <> NEW.provider_idempotency_token THEN
+      RAISE EXCEPTION 'OUTCOME requires the matching immutable DISPATCHED fence' USING ERRCODE = '23514';
+    END IF;
+  ELSE
+    IF NEW.operation_execution_epoch = 1 THEN
+      NULL;
+    ELSE
+      SELECT * INTO prior_outcome FROM infinity.effect_journal_records
+      WHERE operation_id = NEW.operation_id AND operation_step_id = NEW.operation_step_id
+        AND operation_execution_epoch = NEW.operation_execution_epoch - 1 AND record_kind = 'OUTCOME';
+      IF NOT FOUND OR prior_outcome.outcome_kind <> 'failed_no_effect'
+        OR prior_outcome.operation_digest <> NEW.operation_digest
+        OR prior_outcome.operation_step_digest <> NEW.operation_step_digest
+        OR prior_outcome.request_digest <> NEW.request_digest
+        OR prior_outcome.target_digest <> NEW.target_digest
+        OR prior_outcome.resource_id <> NEW.resource_id
+        OR prior_outcome.resource_lifecycle_generation <> NEW.resource_lifecycle_generation
+        OR prior_outcome.predecessor_receipt_digest IS DISTINCT FROM NEW.predecessor_receipt_digest
+        OR prior_outcome.provider_idempotency_token <> NEW.provider_idempotency_token THEN
+        RAISE EXCEPTION 'higher execution epoch lacks stable failed_no_effect predecessor' USING ERRCODE = '23514';
+      END IF;
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER run_specs_immutable BEFORE UPDATE OR DELETE ON infinity.run_specs
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER admission_keys_immutable BEFORE UPDATE OR DELETE ON infinity.admission_keys
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER attempt_lease_grants_immutable BEFORE UPDATE OR DELETE ON infinity.attempt_lease_grants
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER attempt_lease_events_immutable BEFORE UPDATE OR DELETE ON infinity.attempt_lease_events
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER events_immutable BEFORE UPDATE OR DELETE ON infinity.events
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER effect_operation_steps_immutable BEFORE UPDATE OR DELETE ON infinity.effect_operation_steps
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER effect_journal_records_immutable BEFORE UPDATE OR DELETE ON infinity.effect_journal_records
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER effect_journal_insert_guard BEFORE INSERT ON infinity.effect_journal_records
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_effect_journal_insert();
+CREATE TRIGGER authority_mutation_envelope_insert_guard BEFORE INSERT ON infinity.authority_mutation_envelopes
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_authority_mutation_envelope();
+CREATE TRIGGER authority_mutation_acknowledgement_insert_guard BEFORE INSERT ON infinity.authority_mutation_acknowledgements
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_authority_mutation_acknowledgement();
+CREATE TRIGGER authority_ack_frontier_update_guard BEFORE UPDATE ON infinity.authority_runtime_meta
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_authority_ack_frontier_update();
+CREATE TRIGGER outbox_write_guard BEFORE INSERT OR UPDATE ON infinity.outbox
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_outbox_write();
+
+CREATE TRIGGER run_specs_mutation_capture AFTER INSERT ON infinity.run_specs
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER runs_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.runs
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER attempts_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.attempts
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER attempt_lease_grants_mutation_capture AFTER INSERT ON infinity.attempt_lease_grants
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER attempt_lease_events_mutation_capture AFTER INSERT ON infinity.attempt_lease_events
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER queue_entries_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.queue_entries
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER budget_reservations_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.budget_reservations
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER admission_keys_mutation_capture AFTER INSERT ON infinity.admission_keys
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER idempotency_records_mutation_capture AFTER INSERT OR UPDATE ON infinity.idempotency_records
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER event_stream_heads_mutation_capture AFTER INSERT OR UPDATE ON infinity.event_stream_heads
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER events_mutation_capture AFTER INSERT ON infinity.events
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER outbox_mutation_capture AFTER INSERT ON infinity.outbox
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER external_operations_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.external_operations
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER authority_runtime_meta_mutation_capture AFTER UPDATE ON infinity.authority_runtime_meta
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+
+CREATE TRIGGER authority_mutation_change_buffer_immutable BEFORE UPDATE OR DELETE ON infinity.authority_mutation_change_buffer
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER authority_mutation_envelopes_immutable BEFORE UPDATE OR DELETE ON infinity.authority_mutation_envelopes
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER authority_mutation_acknowledgements_immutable BEFORE UPDATE OR DELETE ON infinity.authority_mutation_acknowledgements
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+
+INSERT INTO infinity.authority_epochs (
+  authority_epoch, state, activation_receipt_digest, activated_at, is_current
+) VALUES (
+  1, 'reconciled', 'sha256:0000000000000000000000000000000000000000000000000000000000000000', clock_timestamp(), true
+) ON CONFLICT (authority_epoch) DO NOTHING;
+
+INSERT INTO infinity.authority_runtime_meta (
+  singleton, next_queue_sequence, next_commit_sequence, journal_acknowledged_through,
+  budget_limit_units, budget_reserved_units, budget_charged_units, budget_released_units
+) VALUES (true, 1, 1, 0, 1000000, 0, 0, 0)
+ON CONFLICT (singleton) DO NOTHING;
+
+INSERT INTO infinity.routes (route_lineage_id, route_id, route_epoch, state)
+VALUES ('route-lineage-direct', 'route-direct', 1, 'active')
+ON CONFLICT (route_lineage_id) DO NOTHING;
+
+INSERT INTO infinity.effect_journal_frontier (singleton, journal_sequence, frontier_digest, updated_at)
+VALUES (true, 0, NULL, clock_timestamp())
+ON CONFLICT (singleton) DO NOTHING;
+
+CREATE TRIGGER authority_epochs_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.authority_epochs
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER routes_mutation_capture AFTER INSERT OR UPDATE OR DELETE ON infinity.routes
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();