@hasna/infinity 0.1.0

package/migrations/0002_effect_step_global_owner.sql

@@ -0,0 +1,2 @@
+ALTER TABLE infinity.effect_operation_steps
+  ADD CONSTRAINT effect_operation_steps_global_id_unique UNIQUE (operation_step_id);

package/migrations/0003_effect_journal_observed_head.sql

@@ -0,0 +1,34 @@
+CREATE TABLE infinity.effect_journal_observed_head (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  journal_sequence bigint NOT NULL CHECK (journal_sequence >= 0),
+  frontier_digest text CHECK (frontier_digest IS NULL OR frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  head_receipt jsonb NOT NULL,
+  updated_at timestamptz NOT NULL,
+  CHECK ((journal_sequence = 0) = (frontier_digest IS NULL))
+);
+
+CREATE OR REPLACE FUNCTION infinity.validate_effect_journal_observed_head_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'effect journal observed head cannot be deleted' USING ERRCODE = '55000';
+  END IF;
+  IF TG_OP = 'UPDATE' AND (
+    NEW.singleton IS DISTINCT FROM OLD.singleton
+    OR NEW.journal_sequence < OLD.journal_sequence
+    OR (NEW.journal_sequence = OLD.journal_sequence
+      AND NEW.frontier_digest IS DISTINCT FROM OLD.frontier_digest)
+  ) THEN
+    RAISE EXCEPTION 'effect journal observed head cannot roll back or equivocate' USING ERRCODE = '23514';
+  END IF;
+  IF (NEW.head_receipt->>'journal_sequence')::bigint IS DISTINCT FROM NEW.journal_sequence
+    OR NEW.head_receipt->>'frontier_digest' IS DISTINCT FROM NEW.frontier_digest THEN
+    RAISE EXCEPTION 'effect journal observed head columns differ from signed receipt' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER effect_journal_observed_head_guard
+BEFORE INSERT OR UPDATE OR DELETE ON infinity.effect_journal_observed_head
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_effect_journal_observed_head_update();

package/migrations/0004_authority_mutation_journal_binding.sql

@@ -0,0 +1,15 @@
+CREATE TABLE infinity.authority_mutation_journal_binding (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  journal_id text NOT NULL,
+  restore_domain_id text NOT NULL,
+  durability text NOT NULL CHECK (durability = 'durable'),
+  encrypted_at_rest boolean NOT NULL CHECK (encrypted_at_rest),
+  signer_principal text NOT NULL,
+  signing_key_id text NOT NULL,
+  protection_digest text NOT NULL CHECK (protection_digest ~ '^sha256:[0-9a-f]{64}$'),
+  bound_at timestamptz NOT NULL
+);
+
+CREATE TRIGGER authority_mutation_journal_binding_immutable
+BEFORE UPDATE OR DELETE ON infinity.authority_mutation_journal_binding
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();

package/migrations/20260710_checkpoint_broker_v1.sql

@@ -0,0 +1,163 @@
+CREATE TABLE IF NOT EXISTS infinity_schema_migrations (
+  migration_id text PRIMARY KEY,
+  applied_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE TABLE IF NOT EXISTS infinity_broker_operations (
+  operation_id text PRIMARY KEY,
+  operation_digest text NOT NULL CHECK (operation_digest ~ '^sha256:[0-9a-f]{64}$'),
+  fence_canonical_json text NOT NULL,
+  state text NOT NULL CHECK (state IN ('in_flight', 'committed', 'unknown_requires_review')),
+  owner_execution_id uuid NOT NULL,
+  execution_expires_at timestamptz NOT NULL,
+  result_canonical_json text,
+  unknown_reason_code text,
+  reconciliation_evidence_sha256 text CHECK (reconciliation_evidence_sha256 IS NULL OR reconciliation_evidence_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  reconciled_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  CHECK (state <> 'committed' OR result_canonical_json IS NOT NULL),
+  CHECK (state <> 'in_flight' OR result_canonical_json IS NULL),
+  CHECK (state <> 'unknown_requires_review' OR unknown_reason_code IS NOT NULL),
+  CHECK ((reconciliation_evidence_sha256 IS NULL) = (reconciled_at IS NULL))
+);
+
+CREATE TABLE IF NOT EXISTS infinity_provider_steps (
+  operation_id text NOT NULL REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  step_key text NOT NULL,
+  step_digest text NOT NULL CHECK (step_digest ~ '^sha256:[0-9a-f]{64}$'),
+  action text NOT NULL,
+  fence_canonical_json text NOT NULL,
+  request_canonical_json text NOT NULL,
+  state text NOT NULL CHECK (state IN ('prepared', 'dispatched', 'succeeded', 'failed_no_effect', 'unknown_requires_review')),
+  owner_execution_id uuid NOT NULL,
+  parent_owner_execution_id uuid NOT NULL,
+  execution_expires_at timestamptz NOT NULL,
+  resource_generation_before numeric(19, 0) NOT NULL CHECK (resource_generation_before > 0 AND resource_generation_before <= 9223372036854775807),
+  resource_generation_after numeric(19, 0) NOT NULL CHECK (resource_generation_after > 0 AND resource_generation_after <= 9223372036854775807),
+  provider_request_id text,
+  provider_client_token_fingerprint text CHECK (provider_client_token_fingerprint IS NULL OR provider_client_token_fingerprint ~ '^sha256:[0-9a-f]{64}$'),
+  result_canonical_json text,
+  unknown_reason_code text,
+  reconciliation_provider_request_id text,
+  reconciliation_evidence_sha256 text CHECK (reconciliation_evidence_sha256 IS NULL OR reconciliation_evidence_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  reconciled_at timestamptz,
+  effect_anchor_id text,
+  effect_anchor_event_id text,
+  effect_anchor_core_sha256 text CHECK (effect_anchor_core_sha256 IS NULL OR effect_anchor_core_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  effect_anchor_receipt_sha256 text CHECK (effect_anchor_receipt_sha256 IS NULL OR effect_anchor_receipt_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  effect_anchor_signing_key_id text,
+  effect_anchor_signature_sha256 text CHECK (effect_anchor_signature_sha256 IS NULL OR effect_anchor_signature_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  effect_anchor_committed_at timestamptz,
+  effect_anchor_authority_witness_sha256 text CHECK (effect_anchor_authority_witness_sha256 IS NULL OR effect_anchor_authority_witness_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  effect_anchor_cancellation_witness_sha256 text CHECK (effect_anchor_cancellation_witness_sha256 IS NULL OR effect_anchor_cancellation_witness_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  prepared_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  dispatched_at timestamptz,
+  completed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  PRIMARY KEY (operation_id, step_key),
+  CHECK (state <> 'succeeded' OR result_canonical_json IS NOT NULL),
+  CHECK (state NOT IN ('prepared', 'dispatched', 'failed_no_effect') OR result_canonical_json IS NULL),
+  CHECK ((state IN ('dispatched', 'succeeded', 'failed_no_effect', 'unknown_requires_review')) = (dispatched_at IS NOT NULL)),
+  CHECK ((state IN ('succeeded', 'failed_no_effect', 'unknown_requires_review')) = (completed_at IS NOT NULL)),
+  CHECK (state <> 'unknown_requires_review' OR unknown_reason_code IS NOT NULL),
+  CHECK (
+    (reconciliation_provider_request_id IS NULL AND reconciliation_evidence_sha256 IS NULL AND reconciled_at IS NULL)
+    OR
+    (reconciliation_provider_request_id IS NOT NULL AND reconciliation_evidence_sha256 IS NOT NULL AND reconciled_at IS NOT NULL)
+  ),
+  CHECK (
+    (state = 'prepared'
+      AND effect_anchor_id IS NULL
+      AND effect_anchor_event_id IS NULL
+      AND effect_anchor_core_sha256 IS NULL
+      AND effect_anchor_receipt_sha256 IS NULL
+      AND effect_anchor_signing_key_id IS NULL
+      AND effect_anchor_signature_sha256 IS NULL
+      AND effect_anchor_committed_at IS NULL
+      AND effect_anchor_authority_witness_sha256 IS NULL
+      AND effect_anchor_cancellation_witness_sha256 IS NULL)
+    OR
+    (state <> 'prepared'
+      AND effect_anchor_id IS NOT NULL
+      AND effect_anchor_event_id IS NOT NULL
+      AND effect_anchor_core_sha256 IS NOT NULL
+      AND effect_anchor_receipt_sha256 IS NOT NULL
+      AND effect_anchor_signing_key_id IS NOT NULL
+      AND effect_anchor_signature_sha256 IS NOT NULL
+      AND effect_anchor_committed_at IS NOT NULL
+      AND effect_anchor_authority_witness_sha256 IS NOT NULL
+      AND effect_anchor_cancellation_witness_sha256 IS NOT NULL
+      AND effect_anchor_committed_at < execution_expires_at)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS infinity_provider_steps_state_idx
+  ON infinity_provider_steps (state, execution_expires_at);
+
+CREATE TABLE IF NOT EXISTS infinity_checkpoint_seals (
+  checkpoint_id text PRIMARY KEY,
+  operation_id text NOT NULL UNIQUE REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  seal_core_digest text NOT NULL UNIQUE CHECK (seal_core_digest ~ '^sha256:[0-9a-f]{64}$'),
+  manifest_digest text NOT NULL CHECK (manifest_digest ~ '^sha256:[0-9a-f]{64}$'),
+  fence_canonical_json text NOT NULL,
+  authority_transaction_id text NOT NULL UNIQUE,
+  authority_event_id text NOT NULL UNIQUE,
+  signing_key_id text NOT NULL,
+  signature_sha256 text NOT NULL CHECK (signature_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  seal_receipt_canonical_json text NOT NULL,
+  committed_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE TABLE IF NOT EXISTS infinity_checkpoint_events (
+  event_id text PRIMARY KEY,
+  operation_id text NOT NULL REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  checkpoint_id text NOT NULL REFERENCES infinity_checkpoint_seals(checkpoint_id) ON DELETE RESTRICT,
+  event_type text NOT NULL CHECK (event_type = 'checkpoint_sealed'),
+  event_digest text NOT NULL UNIQUE CHECK (event_digest ~ '^sha256:[0-9a-f]{64}$'),
+  fence_canonical_json text NOT NULL,
+  payload_canonical_json text NOT NULL,
+  created_at timestamptz NOT NULL
+);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'infinity_checkpoint_seals_event_fk') THEN
+    ALTER TABLE infinity_checkpoint_seals
+      ADD CONSTRAINT infinity_checkpoint_seals_event_fk
+      FOREIGN KEY (authority_event_id) REFERENCES infinity_checkpoint_events(event_id)
+      DEFERRABLE INITIALLY DEFERRED;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity_reject_checkpoint_seal_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'infinity checkpoint seals are append-only';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS infinity_checkpoint_seals_append_only ON infinity_checkpoint_seals;
+CREATE TRIGGER infinity_checkpoint_seals_append_only
+BEFORE UPDATE OR DELETE ON infinity_checkpoint_seals
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_checkpoint_seal_mutation();
+
+DROP TRIGGER IF EXISTS infinity_checkpoint_events_append_only ON infinity_checkpoint_events;
+CREATE TRIGGER infinity_checkpoint_events_append_only
+BEFORE UPDATE OR DELETE ON infinity_checkpoint_events
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_checkpoint_seal_mutation();
+
+DROP TRIGGER IF EXISTS infinity_checkpoint_seals_no_truncate ON infinity_checkpoint_seals;
+CREATE TRIGGER infinity_checkpoint_seals_no_truncate
+BEFORE TRUNCATE ON infinity_checkpoint_seals
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_checkpoint_seal_mutation();
+
+DROP TRIGGER IF EXISTS infinity_checkpoint_events_no_truncate ON infinity_checkpoint_events;
+CREATE TRIGGER infinity_checkpoint_events_no_truncate
+BEFORE TRUNCATE ON infinity_checkpoint_events
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_checkpoint_seal_mutation();

package/migrations/20260711_accounts_operation_v1.sql

@@ -0,0 +1,137 @@
+-- Durable Accounts operation authority. Every mutable projection is captured by
+-- the existing authority mutation journal; signed evidence and frontier members
+-- are append-only and retain their exact canonical bytes.
+
+CREATE TABLE infinity.accounts_resource_authority (
+  resource_lease_id text PRIMARY KEY,
+  effect_namespace_id text NOT NULL,
+  serialization_key_digest text NOT NULL CHECK (serialization_key_digest ~ '^sha256:[0-9a-f]{64}$'),
+  resource_id text NOT NULL,
+  resource_lifecycle_generation bigint NOT NULL CHECK (resource_lifecycle_generation > 0),
+  run_id text NOT NULL REFERENCES infinity.runs(id),
+  attempt_id text NOT NULL REFERENCES infinity.attempts(id),
+  attempt_lease_id text NOT NULL,
+  lease_epoch bigint NOT NULL CHECK (lease_epoch > 0),
+  projection_digest text NOT NULL UNIQUE CHECK (projection_digest ~ '^sha256:[0-9a-f]{64}$'),
+  projection_record text NOT NULL,
+  installed_at timestamptz NOT NULL,
+  UNIQUE (effect_namespace_id, serialization_key_digest),
+  FOREIGN KEY (attempt_lease_id, attempt_id, lease_epoch)
+    REFERENCES infinity.attempt_lease_grants(attempt_lease_id, attempt_id, lease_epoch)
+);
+
+CREATE TABLE infinity.accounts_operation_signer_pin (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  trust_anchor_digest text NOT NULL CHECK (trust_anchor_digest ~ '^sha256:[0-9a-f]{64}$'),
+  head_sequence bigint NOT NULL CHECK (head_sequence > 0),
+  head_digest text NOT NULL CHECK (head_digest ~ '^sha256:[0-9a-f]{64}$'),
+  pin_digest text NOT NULL CHECK (pin_digest ~ '^sha256:[0-9a-f]{64}$'),
+  pin_record text NOT NULL,
+  updated_at timestamptz NOT NULL
+);
+
+CREATE OR REPLACE FUNCTION infinity.validate_accounts_operation_signer_pin_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF NEW.trust_anchor_digest IS DISTINCT FROM OLD.trust_anchor_digest
+    OR NEW.head_sequence < OLD.head_sequence
+    OR (NEW.head_sequence = OLD.head_sequence AND (
+      NEW.head_digest IS DISTINCT FROM OLD.head_digest
+      OR NEW.pin_digest IS DISTINCT FROM OLD.pin_digest
+      OR NEW.pin_record IS DISTINCT FROM OLD.pin_record
+    )) THEN
+    RAISE EXCEPTION 'accounts signer-history pin update rewinds or equivocates'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TABLE infinity.accounts_serialization_domains (
+  domain_key text PRIMARY KEY CHECK (domain_key ~ '^sha256:[0-9a-f]{64}$'),
+  effect_namespace_id text NOT NULL,
+  serialization_key_digest text NOT NULL CHECK (serialization_key_digest ~ '^sha256:[0-9a-f]{64}$'),
+  resource_lease_id text NOT NULL UNIQUE REFERENCES infinity.accounts_resource_authority(resource_lease_id),
+  active_model_operation_id text,
+  revision bigint NOT NULL CHECK (revision > 0),
+  state_digest text NOT NULL CHECK (state_digest ~ '^sha256:[0-9a-f]{64}$'),
+  state_record text NOT NULL,
+  created_at timestamptz NOT NULL,
+  updated_at timestamptz NOT NULL CHECK (updated_at >= created_at),
+  UNIQUE (effect_namespace_id, serialization_key_digest)
+);
+
+CREATE TABLE infinity.accounts_serialization_frontier_heads (
+  domain_key text NOT NULL REFERENCES infinity.accounts_serialization_domains(domain_key),
+  frontier_kind text NOT NULL CHECK (frontier_kind IN ('RESOURCE_LEASE','MODEL_EFFECT','DELIVERY')),
+  frontier_sequence bigint NOT NULL CHECK (frontier_sequence >= 0),
+  predecessor_frontier_hash text NOT NULL CHECK (predecessor_frontier_hash ~ '^sha256:[0-9a-f]{64}$'),
+  last_record_digest text NOT NULL CHECK (last_record_digest ~ '^sha256:[0-9a-f]{64}$'),
+  head_digest text NOT NULL UNIQUE CHECK (head_digest ~ '^sha256:[0-9a-f]{64}$'),
+  head_jcs_base64url text NOT NULL,
+  head_record text NOT NULL,
+  recorded_at timestamptz NOT NULL,
+  PRIMARY KEY (domain_key, frontier_kind, frontier_sequence)
+);
+
+CREATE TABLE infinity.accounts_model_call_operations (
+  operation_id text PRIMARY KEY,
+  domain_key text NOT NULL REFERENCES infinity.accounts_serialization_domains(domain_key),
+  prepare_input_digest text NOT NULL CHECK (prepare_input_digest ~ '^sha256:[0-9a-f]{64}$'),
+  state text NOT NULL CHECK (state IN ('PREPARED','CONSUME_BOUND')),
+  consume_receipt_digest text UNIQUE CHECK (consume_receipt_digest IS NULL OR consume_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  use_id text UNIQUE CHECK (use_id IS NULL OR use_id ~ '^sha256:[0-9a-f]{64}$'),
+  projection_digest text NOT NULL CHECK (projection_digest ~ '^sha256:[0-9a-f]{64}$'),
+  projection_record text NOT NULL,
+  created_at timestamptz NOT NULL,
+  updated_at timestamptz NOT NULL CHECK (updated_at >= created_at),
+  CHECK ((state = 'PREPARED' AND consume_receipt_digest IS NULL AND use_id IS NULL)
+      OR (state = 'CONSUME_BOUND' AND consume_receipt_digest IS NOT NULL AND use_id IS NOT NULL))
+);
+
+CREATE TABLE infinity.accounts_model_effect_journal (
+  domain_key text NOT NULL REFERENCES infinity.accounts_serialization_domains(domain_key),
+  journal_sequence bigint NOT NULL CHECK (journal_sequence > 0),
+  operation_id text NOT NULL REFERENCES infinity.accounts_model_call_operations(operation_id),
+  record_kind text NOT NULL CHECK (record_kind IN ('PREPARED','CONSUME_BOUND')),
+  prior_frontier_hash text NOT NULL CHECK (prior_frontier_hash ~ '^sha256:[0-9a-f]{64}$'),
+  record_digest text NOT NULL UNIQUE CHECK (record_digest ~ '^sha256:[0-9a-f]{64}$'),
+  frontier_hash text NOT NULL UNIQUE CHECK (frontier_hash ~ '^sha256:[0-9a-f]{64}$'),
+  entry_digest text NOT NULL CHECK (entry_digest ~ '^sha256:[0-9a-f]{64}$'),
+  entry_record text NOT NULL,
+  recorded_at timestamptz NOT NULL,
+  PRIMARY KEY (domain_key, journal_sequence),
+  UNIQUE (operation_id, record_kind)
+);
+
+CREATE TRIGGER accounts_resource_authority_immutable
+BEFORE UPDATE OR DELETE ON infinity.accounts_resource_authority
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER accounts_operation_signer_pin_update_guard
+BEFORE UPDATE ON infinity.accounts_operation_signer_pin
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_accounts_operation_signer_pin_update();
+CREATE TRIGGER accounts_frontier_heads_immutable
+BEFORE UPDATE OR DELETE ON infinity.accounts_serialization_frontier_heads
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+CREATE TRIGGER accounts_model_effect_journal_immutable
+BEFORE UPDATE OR DELETE ON infinity.accounts_model_effect_journal
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+
+CREATE TRIGGER accounts_resource_authority_mutation_capture
+AFTER INSERT ON infinity.accounts_resource_authority
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER accounts_operation_signer_pin_mutation_capture
+AFTER INSERT OR UPDATE ON infinity.accounts_operation_signer_pin
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER accounts_serialization_domains_mutation_capture
+AFTER INSERT OR UPDATE ON infinity.accounts_serialization_domains
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER accounts_frontier_heads_mutation_capture
+AFTER INSERT ON infinity.accounts_serialization_frontier_heads
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER accounts_model_call_operations_mutation_capture
+AFTER INSERT OR UPDATE ON infinity.accounts_model_call_operations
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+CREATE TRIGGER accounts_model_effect_journal_mutation_capture
+AFTER INSERT ON infinity.accounts_model_effect_journal
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();

package/migrations/20260711_checkpoint_trust_v2.sql

@@ -0,0 +1,17 @@
+CREATE TABLE IF NOT EXISTS infinity_manifest_signing_trust_current (
+  trust_anchor_sha256 text PRIMARY KEY CHECK (trust_anchor_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  head_sequence numeric(19, 0) NOT NULL CHECK (head_sequence > 0 AND head_sequence <= 9223372036854775807),
+  observation_sequence numeric(19, 0) NOT NULL UNIQUE CHECK (observation_sequence > 0 AND observation_sequence <= 9223372036854775807),
+  head_canonical_json text NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE TABLE IF NOT EXISTS infinity_verification_final_trust_authorizations (
+  signed_receipt_sha256 text PRIMARY KEY CHECK (signed_receipt_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  manifest_signing_key_id text NOT NULL,
+  trust_anchor_sha256 text NOT NULL REFERENCES infinity_manifest_signing_trust_current(trust_anchor_sha256) ON DELETE RESTRICT,
+  signing_trust_head_sha256 text NOT NULL CHECK (signing_trust_head_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  authorization_canonical_json text NOT NULL,
+  authorized_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);

package/migrations/20260711_verifier_cleanup_v2.sql

@@ -0,0 +1,169 @@
+CREATE TABLE IF NOT EXISTS infinity_verifier_cleanup_grants (
+  grant_sha256 text PRIMARY KEY CHECK (grant_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  grant_request_sha256 text NOT NULL CHECK (grant_request_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  supersedes_grant_sha256 text UNIQUE REFERENCES infinity_verifier_cleanup_grants(grant_sha256) ON DELETE RESTRICT,
+  cleanup_nonce text NOT NULL UNIQUE,
+  consumption_transaction_id text NOT NULL UNIQUE,
+  verification_operation_id text NOT NULL,
+  cleanup_operation_id text NOT NULL UNIQUE REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  resource_id text NOT NULL,
+  resource_lease_id text NOT NULL,
+  resource_generation_before numeric(19, 0) NOT NULL CHECK (
+    resource_generation_before > 0 AND resource_generation_before <= 9223372036854775807
+  ),
+  resource_generation_after numeric(19, 0) NOT NULL CHECK (
+    resource_generation_after > 0 AND resource_generation_after <= 9223372036854775807
+  ),
+  grant_canonical_json text NOT NULL,
+  issued_at timestamptz NOT NULL,
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  CHECK (resource_generation_after = resource_generation_before + 1),
+  CHECK (issued_at < expires_at)
+);
+
+CREATE INDEX IF NOT EXISTS infinity_verifier_cleanup_grants_request_idx
+  ON infinity_verifier_cleanup_grants (grant_request_sha256, issued_at DESC);
+
+CREATE TABLE IF NOT EXISTS infinity_verifier_cleanup_resource_heads (
+  resource_id text PRIMARY KEY,
+  resource_lease_id text NOT NULL,
+  resource_generation numeric(19, 0) NOT NULL CHECK (
+    resource_generation > 0 AND resource_generation <= 9223372036854775807
+  ),
+  current_fence_canonical_json text NOT NULL,
+  advanced_by_cleanup_operation_id text UNIQUE REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  updated_at timestamptz NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS infinity_verifier_cleanup_consumptions (
+  consumption_transaction_id text PRIMARY KEY,
+  cleanup_nonce text NOT NULL UNIQUE,
+  grant_sha256 text NOT NULL UNIQUE REFERENCES infinity_verifier_cleanup_grants(grant_sha256) ON DELETE RESTRICT,
+  verification_operation_id text NOT NULL,
+  cleanup_operation_id text NOT NULL UNIQUE REFERENCES infinity_broker_operations(operation_id) ON DELETE RESTRICT,
+  resource_id text NOT NULL,
+  resource_generation_before numeric(19, 0) NOT NULL CHECK (
+    resource_generation_before > 0 AND resource_generation_before <= 9223372036854775807
+  ),
+  resource_generation_after numeric(19, 0) NOT NULL CHECK (
+    resource_generation_after > 0 AND resource_generation_after <= 9223372036854775807
+  ),
+  sandboxes_receipt_sha256 text NOT NULL UNIQUE CHECK (sandboxes_receipt_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_canonical_json text NOT NULL,
+  receipt_bytes_sha256 text NOT NULL CHECK (receipt_bytes_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  commit_canonical_json text NOT NULL,
+  logical_cleanup_state text NOT NULL CHECK (logical_cleanup_state = 'committed'),
+  promotion_gate text NOT NULL CHECK (promotion_gate IN ('open', 'closed')),
+  authority_transaction_id text NOT NULL UNIQUE,
+  authority_event_id text NOT NULL UNIQUE,
+  committed_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (resource_id, resource_generation_before),
+  CHECK (resource_generation_after = resource_generation_before + 1)
+);
+
+CREATE INDEX IF NOT EXISTS infinity_verifier_cleanup_consumptions_resource_idx
+  ON infinity_verifier_cleanup_consumptions (resource_id, resource_generation_after DESC);
+
+CREATE TABLE IF NOT EXISTS infinity_verifier_completion_preparations (
+  verification_operation_id text PRIMARY KEY,
+  handoff_sha256 text NOT NULL CHECK (handoff_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  completion_input_canonical_json text NOT NULL,
+  created_at timestamptz NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS infinity_verifier_passing_receipts (
+  verification_operation_id text PRIMARY KEY,
+  handoff_sha256 text NOT NULL CHECK (handoff_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  cleanup_consumption_transaction_id text NOT NULL UNIQUE REFERENCES infinity_verifier_cleanup_consumptions(consumption_transaction_id) ON DELETE RESTRICT,
+  cleanup_commit_sha256 text NOT NULL UNIQUE CHECK (cleanup_commit_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_sha256 text NOT NULL UNIQUE CHECK (receipt_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_canonical_json text NOT NULL,
+  created_at timestamptz NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS infinity_verifier_quarantine_receipts (
+  quarantine_receipt_sha256 text PRIMARY KEY CHECK (quarantine_receipt_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  verification_operation_id text NOT NULL,
+  quarantine_reason text NOT NULL CHECK (quarantine_reason IN ('invalid_allocation', 'cleanup_failure')),
+  resource_id text NOT NULL,
+  resource_lease_id text NOT NULL,
+  resource_generation numeric(19, 0) NOT NULL CHECK (
+    resource_generation > 0 AND resource_generation <= 9223372036854775807
+  ),
+  quarantine_subject_sha256 text NOT NULL CHECK (quarantine_subject_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_canonical_json text NOT NULL,
+  receipt_bytes_sha256 text NOT NULL CHECK (receipt_bytes_sha256 ~ '^sha256:[0-9a-f]{64}$'),
+  recorded_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE OR REPLACE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'infinity verifier cleanup consumptions are append-only';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS infinity_verifier_cleanup_consumptions_append_only
+  ON infinity_verifier_cleanup_consumptions;
+CREATE TRIGGER infinity_verifier_cleanup_consumptions_append_only
+BEFORE UPDATE OR DELETE ON infinity_verifier_cleanup_consumptions
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_cleanup_grants_append_only
+  ON infinity_verifier_cleanup_grants;
+CREATE TRIGGER infinity_verifier_cleanup_grants_append_only
+BEFORE UPDATE OR DELETE ON infinity_verifier_cleanup_grants
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_quarantine_receipts_append_only
+  ON infinity_verifier_quarantine_receipts;
+CREATE TRIGGER infinity_verifier_quarantine_receipts_append_only
+BEFORE UPDATE OR DELETE ON infinity_verifier_quarantine_receipts
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_passing_receipts_append_only
+  ON infinity_verifier_passing_receipts;
+CREATE TRIGGER infinity_verifier_passing_receipts_append_only
+BEFORE UPDATE OR DELETE ON infinity_verifier_passing_receipts
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_completion_preparations_append_only
+  ON infinity_verifier_completion_preparations;
+CREATE TRIGGER infinity_verifier_completion_preparations_append_only
+BEFORE UPDATE OR DELETE ON infinity_verifier_completion_preparations
+FOR EACH ROW EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_cleanup_consumptions_no_truncate
+  ON infinity_verifier_cleanup_consumptions;
+CREATE TRIGGER infinity_verifier_cleanup_consumptions_no_truncate
+BEFORE TRUNCATE ON infinity_verifier_cleanup_consumptions
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_cleanup_grants_no_truncate
+  ON infinity_verifier_cleanup_grants;
+CREATE TRIGGER infinity_verifier_cleanup_grants_no_truncate
+BEFORE TRUNCATE ON infinity_verifier_cleanup_grants
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_quarantine_receipts_no_truncate
+  ON infinity_verifier_quarantine_receipts;
+CREATE TRIGGER infinity_verifier_quarantine_receipts_no_truncate
+BEFORE TRUNCATE ON infinity_verifier_quarantine_receipts
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_passing_receipts_no_truncate
+  ON infinity_verifier_passing_receipts;
+CREATE TRIGGER infinity_verifier_passing_receipts_no_truncate
+BEFORE TRUNCATE ON infinity_verifier_passing_receipts
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();
+
+DROP TRIGGER IF EXISTS infinity_verifier_completion_preparations_no_truncate
+  ON infinity_verifier_completion_preparations;
+CREATE TRIGGER infinity_verifier_completion_preparations_no_truncate
+BEFORE TRUNCATE ON infinity_verifier_completion_preparations
+FOR EACH STATEMENT EXECUTE FUNCTION infinity_reject_verifier_cleanup_consumption_mutation();