@intx/db 0.2.2 → 0.3.0

package/migrations/0063_repoint_agent_role_fk_to_definition.sql

@@ -0,0 +1,39 @@
+-- Re-point the agent_role foreign key off the agent onto the folded workflow
+-- definition. The column keeps its agent_id name, but its values become
+-- workflow_definition ids: every agent was folded to exactly one definition,
+-- linked by workflow_definition.origin_agent_id (a partial unique index, so
+-- the join matches at most one definition). Role assignments follow the
+-- definition so they survive the agent table's retirement.
+--
+-- The guard runs before any write. The production path applies migrations under
+-- `drizzle-kit migrate`, which wraps the pending set in a transaction, and
+-- PostgreSQL DDL is transactional, so an aborting guard rolls the whole set
+-- back -- there is no partial commit to defend against. It aborts loudly if any
+-- agent_role row references an agent with no folded definition, meaning the
+-- agent fold has not run; the total fold makes that impossible in a folded
+-- database, so the guard is a fail-loud assertion.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "agent_role" ar
+    WHERE NOT EXISTS (
+      SELECT 1 FROM "workflow_definition" wd
+      WHERE wd.origin_agent_id = ar.agent_id
+    )
+  ) THEN
+    RAISE EXCEPTION 'agent_role row(s) reference an agent with no folded definition; run the agent fold (bin/db-backfill) before applying this migration';
+  END IF;
+END $$;
+--> statement-breakpoint
+-- Drop the old agent foreign key BEFORE rewriting the values: the rewrite sets
+-- agent_id to a workflow_definition id, which is not an agent id, so it would
+-- violate the still-active agent FK.
+ALTER TABLE "agent_role" DROP CONSTRAINT "agent_role_agent_id_agent_id_fk";
+--> statement-breakpoint
+UPDATE "agent_role" ar
+SET agent_id = wd.id
+FROM "workflow_definition" wd
+WHERE wd.origin_agent_id = ar.agent_id;
+--> statement-breakpoint
+ALTER TABLE "agent_role" ADD CONSTRAINT "agent_role_agent_id_workflow_definition_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."workflow_definition"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0064_repoint_agent_session_fk_to_definition.sql

@@ -0,0 +1,47 @@
+-- Re-point the agent_session foreign key off the agent onto the folded
+-- workflow definition. The column keeps its agent_id name, but its values
+-- become workflow_definition ids: a launched session is keyed to the folded
+-- definition it runs, so it survives the agent table's retirement. The delete
+-- rule also changes -- cascade (on agent, from 0008) becomes restrict: session
+-- history is an audit record, so a definition with live sessions must not be
+-- droppable out from under them.
+--
+-- The guard runs before any write. The production path applies migrations under
+-- `drizzle-kit migrate`, which wraps the pending set in a transaction, and
+-- PostgreSQL DDL is transactional, so an aborting guard rolls the whole set
+-- back -- there is no partial commit to defend against.
+-- Unlike the offering (0058) and agent_role (0063) re-points, it guards the
+-- AGENT table, not agent_session: the launch handler writes a fresh
+-- agent_session row at runtime for an agent that may have no existing sessions,
+-- so a child-table guard would pass vacuously for a never-launched unfolded
+-- agent and the writer would then explode on its undefined definition id.
+-- Every agent folded implies every session's agent folded, covering both this
+-- historical rewrite and the runtime writer.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "agent" a
+    WHERE NOT EXISTS (
+      SELECT 1 FROM "workflow_definition" wd
+      WHERE wd.origin_agent_id = a.id
+    )
+  ) THEN
+    RAISE EXCEPTION 'agent(s) have no folded definition; run the agent fold (bin/db-backfill) before applying this migration';
+  END IF;
+END $$;
+--> statement-breakpoint
+-- Drop the old agent foreign key BEFORE rewriting the values: the rewrite sets
+-- agent_id to a workflow_definition id, which is not an agent id, so it would
+-- violate the still-active agent FK. agent_session's agent FK was written as a
+-- raw inline REFERENCES in 0008, so Postgres auto-named it
+-- agent_session_agent_id_fkey -- not the drizzle-style
+-- agent_session_agent_id_agent_id_fk the snapshot infers.
+ALTER TABLE "agent_session" DROP CONSTRAINT "agent_session_agent_id_fkey";
+--> statement-breakpoint
+UPDATE "agent_session" s
+SET agent_id = wd.id
+FROM "workflow_definition" wd
+WHERE wd.origin_agent_id = s.agent_id;
+--> statement-breakpoint
+ALTER TABLE "agent_session" ADD CONSTRAINT "agent_session_agent_id_workflow_definition_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."workflow_definition"("id") ON DELETE restrict ON UPDATE no action;

package/migrations/0065_add_workflow_definition_model_requirements.sql

@@ -0,0 +1,37 @@
+-- Mirror each folded agent's model requirements onto its definition, so a
+-- folded launch resolves its inference sources from the definition rather than
+-- the agent row. The column is folded-only: null for a workflow-origin
+-- definition, which carries no requirements manifest. A null/empty manifest is
+-- legitimate -- it resolves to an unlaunchable empty source chain, exactly as
+-- the agent field did -- so the copy preserves null verbatim and the column
+-- takes no NOT NULL constraint.
+--
+-- Guard first: the backfill joins each folded definition to its agent over
+-- origin_agent_id, a plain text column rather than an FK. If any folded
+-- definition names an agent that does not exist, the join silently skips it and
+-- its column stays null -- indistinguishable from a legitimately-null manifest.
+-- Fail loud before writing so a broken back-reference surfaces here, not as a
+-- mysteriously unlaunchable agent later. The production path applies migrations
+-- under `drizzle-kit migrate`, which wraps the pending set in a transaction, and
+-- PostgreSQL DDL is transactional, so an aborting guard rolls the whole set back
+-- rather than leaving a half-applied backfill.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "workflow_definition" wd
+    WHERE wd.origin_agent_id IS NOT NULL
+      AND NOT EXISTS (
+        SELECT 1 FROM "agent" a WHERE a.id = wd.origin_agent_id
+      )
+  ) THEN
+    RAISE EXCEPTION 'folded definition(s) reference a missing agent; cannot backfill workflow_definition.model_requirements';
+  END IF;
+END $$;
+--> statement-breakpoint
+ALTER TABLE "workflow_definition" ADD COLUMN "model_requirements" jsonb;
+--> statement-breakpoint
+UPDATE "workflow_definition" wd
+SET model_requirements = a.model_requirements
+FROM "agent" a
+WHERE wd.origin_agent_id = a.id;

package/migrations/0066_rekey_agent_definition_principals_to_workflow.sql

@@ -0,0 +1,27 @@
+-- Re-key each folded agent's actor identity onto the workflow model. A
+-- definition-level agent principal's ref_id is the legacy agent id; the fold
+-- moved that agent onto a workflow_definition, so its principal moves too --
+-- kind agent -> workflow, ref_id agent.id -> definition.id. Afterwards the
+-- folded agent's stable identity is a workflow-kind principal keyed by the
+-- definition, and any grants it owns ride along under the new key untouched.
+--
+-- The mapping is 1:1 per tenant, which is what keeps the rewrite from
+-- colliding on principal's UNIQUE(tenant_id, kind, ref_id): the partial-unique
+-- index on workflow_definition.origin_agent_id admits at most one definition
+-- per agent id, so no two agent principals collapse onto the same workflow key.
+-- Existing workflow principals key on a run id, never a definition id, so the
+-- re-keyed rows cannot collide with them either. The tenant predicate holds the
+-- rewrite inside a single tenant even though agent ids are globally unique.
+--
+-- Only the definition-level class re-keys. An instance-level agent principal's
+-- ref_id is an agent_instance id, which matches no origin_agent_id (disjoint id
+-- spaces), so the join leaves it kind agent -- it retires later with the
+-- agent_instance table it depends on. Idempotent: kind = 'agent' guards the
+-- rewrite, and once it runs no definition principal remains agent-kind, so a
+-- re-run is a no-op.
+UPDATE "principal" p
+SET kind = 'workflow', ref_id = wd.id
+FROM "workflow_definition" wd
+WHERE p.kind = 'agent'
+  AND wd.origin_agent_id = p.ref_id
+  AND wd.tenant_id = p.tenant_id;

package/migrations/0067_add_workflow_definition_kind.sql

@@ -0,0 +1,10 @@
+-- Classify each definition as a single-instance launch target (`instance`) or a
+-- multi-step workflow deploy target (`workflow`), so the launch route can gate
+-- on `kind` instead of `origin_agent_id` -- letting that column be dropped
+-- later. Every folded (agent-origin) definition is an instance; a native
+-- workflow-origin definition is a workflow. ADD COLUMN with a `workflow`
+-- default sets every existing row to `workflow`; the backfill then flips the
+-- folded rows, identified by a non-null origin_agent_id, to `instance`.
+ALTER TABLE "workflow_definition" ADD COLUMN "kind" text DEFAULT 'workflow' NOT NULL;
+--> statement-breakpoint
+UPDATE "workflow_definition" SET "kind" = 'instance' WHERE "origin_agent_id" IS NOT NULL;

package/migrations/0068_drop_agent_tables_and_origin_agent_id.sql

@@ -0,0 +1,31 @@
+-- The fold onto workflow_definition/workflow_run is complete: nothing reads
+-- the legacy agent tables or workflow_definition.origin_agent_id anymore. Drop
+-- them. Child-first order (no CASCADE) so a bare DROP fails loudly if an
+-- unmodelled dependent survives. The production path applies migrations under
+-- `drizzle-kit migrate`, which wraps the pending set in a transaction, and
+-- PostgreSQL DDL is transactional, so a guard's abort rolls the whole set back;
+-- there is no partial-commit re-run-from-top mode. The IF EXISTS clauses keep
+-- each drop tolerant of an already-absent relation regardless.
+--
+-- Guard first: agent_instance holds legacy routing, mail, and turn state that
+-- the workflow-asset fold never converted into workflow_run (the fold projected
+-- definitions from assets; it never migrated instances), and the fold tooling
+-- has since been retired, so a bare DROP would destroy that state silently.
+-- Abort while the table still holds rows so the loss is loud, not silent. The
+-- to_regclass check keeps the file idempotent: on a re-run after the drop the
+-- table is gone and the guard is skipped rather than erroring on a missing
+-- relation.
+DO $$
+BEGIN
+  IF to_regclass('agent_instance') IS NOT NULL THEN
+    IF EXISTS (SELECT 1 FROM "agent_instance") THEN
+      RAISE EXCEPTION 'agent_instance still holds rows: dropping the agent tables would destroy legacy agent routing, mail, and turn state that was never folded into workflow_run and has no automated conversion (the fold tooling has been retired). Retire the remaining agent instances by hand before applying this migration (see the agent-fold migration note in DEV.md).';
+    END IF;
+  END IF;
+END $$;
+--> statement-breakpoint
+DROP TABLE IF EXISTS "agent_instance";--> statement-breakpoint
+DROP TABLE IF EXISTS "agent_version";--> statement-breakpoint
+DROP TABLE IF EXISTS "agent";--> statement-breakpoint
+DROP INDEX IF EXISTS "workflow_definition_origin_agent_idx";--> statement-breakpoint
+ALTER TABLE "workflow_definition" DROP COLUMN IF EXISTS "origin_agent_id";

package/migrations/0069_drop_workflow_definition_kind.sql

@@ -0,0 +1,10 @@
+-- The instance/workflow `kind` discriminator is redundant: a run already
+-- classifies structurally (a plain routing address with a null deployment id is
+-- an instance-shaped run; a deployment-anchored run carries its deployment id),
+-- and the interactive-launch path gates on the presence of a model_requirements
+-- manifest instead of kind. Drop the column. The production path applies
+-- migrations under `drizzle-kit migrate`, which wraps the pending set in a
+-- transaction, and PostgreSQL DDL is transactional, so an aborting migration
+-- rolls back with no partial-commit re-run to defend against; the IF EXISTS
+-- keeps the drop tolerant of an already-absent column regardless.
+ALTER TABLE "workflow_definition" DROP COLUMN IF EXISTS "kind";

package/migrations/0070_flashy_proteus.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "workflow_run_execution" (
+	"id" text PRIMARY KEY NOT NULL,
+	"run_id" text NOT NULL,
+	"message_id" text NOT NULL,
+	"status" text DEFAULT 'running' NOT NULL,
+	"started_at" timestamp DEFAULT now() NOT NULL,
+	"ended_at" timestamp,
+	"failure_reason" text
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run_execution" ADD CONSTRAINT "workflow_run_execution_run_id_workflow_run_id_fk" FOREIGN KEY ("run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "workflow_run_execution_run_id_id_idx" ON "workflow_run_execution" USING btree ("run_id","id");--> statement-breakpoint
+CREATE INDEX "workflow_run_execution_status_idx" ON "workflow_run_execution" USING btree ("status");

package/migrations/0072_add_workflow_definition_credential_bindings.sql

@@ -0,0 +1 @@
+ALTER TABLE "workflow_definition" ADD COLUMN "credential_bindings" jsonb;

package/migrations/0073_grant_target_exactly_one_check.sql

@@ -0,0 +1,13 @@
+-- Every grant targets exactly one of a role or a principal. This CHECK is the
+-- universal backstop: it holds for every insert path, including the internal
+-- seeding and materialization sites that never touch the CreateGrant HTTP
+-- validator. On the HTTP path, CreateGrant additionally enforces the same
+-- exactly-one rule so a malformed POST is rejected with a 400 rather than
+-- tripping this constraint as a 500.
+--
+-- On an existing database, ADD CONSTRAINT validates every row and FAILS LOUDLY
+-- if a pre-existing grant carries both targets (or neither) -- rows a prior,
+-- looser write path could have created. That is intentional: a both-target row
+-- is ambiguous to auto-repair, so the migration surfaces it for manual
+-- resolution rather than silently guessing which target to keep.
+ALTER TABLE "grant" ADD CONSTRAINT "grant_target_exactly_one" CHECK (num_nonnulls("grant"."principal_id", "grant"."role_id") = 1);

package/migrations/0074_add_provider_api_base_url.sql

@@ -0,0 +1 @@
+ALTER TABLE "provider" ADD COLUMN "api_base_url" text;

package/migrations/0075_workflow_run_launch_spec.sql

@@ -0,0 +1,17 @@
+CREATE TABLE "workflow_run_launch_spec" (
+	"anchor_run_id" text PRIMARY KEY NOT NULL,
+	"schema_version" integer DEFAULT 1 NOT NULL,
+	"session_id" text NOT NULL,
+	"deployment_domain" text NOT NULL,
+	"source_authority_principal_id" text NOT NULL,
+	"definition_snapshot" jsonb NOT NULL,
+	"definition_hash" text NOT NULL,
+	"source_offering_ids" jsonb NOT NULL,
+	"default_source_offering_id" text NOT NULL,
+	"deploy_content" jsonb NOT NULL,
+	"tool_package_pins" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" ADD CONSTRAINT "workflow_run_launch_spec_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" ADD CONSTRAINT "workflow_run_launch_spec_source_authority_principal_id_principal_id_fk" FOREIGN KEY ("source_authority_principal_id") REFERENCES "public"."principal"("id") ON DELETE restrict ON UPDATE no action;

package/migrations/0076_sidecar_allocation.sql

@@ -0,0 +1,40 @@
+CREATE TABLE "sidecar_allocation" (
+	"id" text PRIMARY KEY NOT NULL,
+	"anchor_run_id" text NOT NULL,
+	"tenant_id" text NOT NULL,
+	"provisioner_id" text NOT NULL,
+	"provisioner_api_version" integer NOT NULL,
+	"provisioner_binding_fingerprint" text NOT NULL,
+	"sidecar_id" text,
+	"placement_sharing" text NOT NULL,
+	"sidecar_reuse" text DEFAULT 'never' NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"generation" integer DEFAULT 0 NOT NULL,
+	"ensure_accepted_generation" integer,
+	"external_ref" text,
+	"next_attempt_at" timestamp,
+	"reconciliation_lease_id" text,
+	"reconciliation_lease_expires_at" timestamp,
+	"ensure_attempts" integer DEFAULT 0 NOT NULL,
+	"destroy_attempts" integer DEFAULT 0 NOT NULL,
+	"connect_deadline" timestamp,
+	"failure_code" text,
+	"failure_message" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "sidecar_allocation_status_check" CHECK ("sidecar_allocation"."status" in ('pending', 'provisioning', 'allocated', 'replacing', 'releasing', 'released', 'failed')),
+	CONSTRAINT "sidecar_allocation_placement_check" CHECK ("sidecar_allocation"."placement_sharing" = 'exclusive'),
+	CONSTRAINT "sidecar_allocation_generation_check" CHECK ("sidecar_allocation"."generation" >= 0),
+	CONSTRAINT "sidecar_allocation_accepted_generation_check" CHECK ("sidecar_allocation"."ensure_accepted_generation" is null or "sidecar_allocation"."ensure_accepted_generation" <= "sidecar_allocation"."generation")
+);
+--> statement-breakpoint
+ALTER TABLE "sidecar" ALTER COLUMN "url" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "sidecar" ADD COLUMN "credential_scope" text DEFAULT 'shared' NOT NULL;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_tenant_id_tenant_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenant"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_sidecar_id_sidecar_id_fk" FOREIGN KEY ("sidecar_id") REFERENCES "public"."sidecar"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "sidecar_allocation_anchor_run_idx" ON "sidecar_allocation" USING btree ("anchor_run_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "sidecar_allocation_active_sidecar_idx" ON "sidecar_allocation" USING btree ("sidecar_id") WHERE "sidecar_allocation"."status" in ('provisioning', 'allocated', 'replacing', 'releasing');--> statement-breakpoint
+CREATE INDEX "sidecar_allocation_sidecar_idx" ON "sidecar_allocation" USING btree ("sidecar_id");--> statement-breakpoint
+CREATE INDEX "sidecar_allocation_reconciliation_idx" ON "sidecar_allocation" USING btree ("next_attempt_at","created_at") WHERE "sidecar_allocation"."status" in ('pending', 'provisioning', 'allocated', 'replacing', 'releasing') and "sidecar_allocation"."next_attempt_at" is not null;--> statement-breakpoint
+ALTER TABLE "sidecar" ADD CONSTRAINT "sidecar_credential_scope_check" CHECK ("sidecar"."credential_scope" in ('shared', 'allocated'));

package/migrations/0077_workflow_run_dispatch.sql

@@ -0,0 +1,29 @@
+CREATE TABLE "workflow_run_dispatch" (
+	"id" text PRIMARY KEY NOT NULL,
+	"anchor_run_id" text NOT NULL,
+	"message_id" text NOT NULL,
+	"raw_message" "bytea" NOT NULL,
+	"step_grants" jsonb NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"acknowledged_generation" integer,
+	"attempt_count" integer DEFAULT 0 NOT NULL,
+	"next_attempt_at" timestamp DEFAULT now(),
+	"delivery_lease_id" text,
+	"delivery_lease_expires_at" timestamp,
+	"failure_code" text,
+	"failure_message" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"acknowledged_at" timestamp,
+	"settled_at" timestamp,
+	CONSTRAINT "workflow_run_dispatch_status_check" CHECK ("workflow_run_dispatch"."status" in ('pending', 'acknowledged', 'settled', 'failed')),
+	CONSTRAINT "workflow_run_dispatch_attempt_count_check" CHECK ("workflow_run_dispatch"."attempt_count" >= 0),
+	CONSTRAINT "workflow_run_dispatch_acknowledged_generation_check" CHECK ("workflow_run_dispatch"."acknowledged_generation" is null or "workflow_run_dispatch"."acknowledged_generation" >= 0),
+	CONSTRAINT "workflow_run_dispatch_acknowledged_state_check" CHECK ("workflow_run_dispatch"."status" <> 'acknowledged' or "workflow_run_dispatch"."acknowledged_generation" is not null),
+	CONSTRAINT "workflow_run_dispatch_pending_schedule_check" CHECK ("workflow_run_dispatch"."status" <> 'pending' or "workflow_run_dispatch"."next_attempt_at" is not null)
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run_dispatch" ADD CONSTRAINT "workflow_run_dispatch_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "workflow_run_dispatch_anchor_message_idx" ON "workflow_run_dispatch" USING btree ("anchor_run_id","message_id");--> statement-breakpoint
+CREATE INDEX "workflow_run_dispatch_delivery_idx" ON "workflow_run_dispatch" USING btree ("next_attempt_at","created_at") WHERE "workflow_run_dispatch"."status" = 'pending';--> statement-breakpoint
+CREATE INDEX "workflow_run_dispatch_anchor_status_idx" ON "workflow_run_dispatch" USING btree ("anchor_run_id","status");

package/migrations/0078_workflow_run_dispatch_kind.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "workflow_run_dispatch" ADD COLUMN "kind" text DEFAULT 'mail' NOT NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_dispatch" ADD CONSTRAINT "workflow_run_dispatch_kind_check" CHECK ("workflow_run_dispatch"."kind" in ('mail', 'signal'));

package/migrations/0079_rename_workflow_run_deployment_id_to_anchor_run_id.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "workflow_run" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "workflow_run" DROP CONSTRAINT "workflow_run_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER TABLE "workflow_run" ADD CONSTRAINT "workflow_run_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0080_rename_correlation_approval_deployment_id_to_anchor_run_id.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "signal_correlation" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "approval" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "approval" DROP CONSTRAINT "approval_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER TABLE "signal_correlation" DROP CONSTRAINT "signal_correlation_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER INDEX "approval_deployment_idx" RENAME TO "approval_anchor_run_idx";--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "signal_correlation" ADD CONSTRAINT "signal_correlation_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0081_workflow_definition_content_hash_and_approved_wire_hash.sql

@@ -0,0 +1,4 @@
+DROP INDEX "workflow_definition_asset_idx";--> statement-breakpoint
+ALTER TABLE "workflow_definition" ADD COLUMN "wire_hash" text;--> statement-breakpoint
+ALTER TABLE "workflow_definition_version" ADD COLUMN "approved_wire_hash" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "workflow_definition_asset_wire_hash_idx" ON "workflow_definition" USING btree ("asset_id","wire_hash");

package/migrations/0082_blue_black_queen.sql

@@ -0,0 +1 @@
+ALTER TABLE "workflow_definition_version" ADD COLUMN "grant_snapshot" jsonb;

package/migrations/0083_replace_launch_spec_snapshot_with_frozen_bundle.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "workflow_run_launch_spec" ADD COLUMN "frozen_approval_bundle" jsonb NOT NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_snapshot";--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_hash";

package/migrations/0084_delete_orphaned_credential_grants.sql

@@ -0,0 +1,22 @@
+-- Remove `credential:{id}` grant rows that reference a credential that no longer
+-- exists. Before credential DELETE cleaned up its per-credential grants, deleting
+-- a personal credential left its `credential:{id}` grant behind, and migration
+-- 0037 backfilled the same shape for pre-existing personal credentials, so a
+-- credential hard-deleted before that cleanup shipped left an orphaned grant.
+--
+-- The coarse wildcard `credential:*` role resource is excluded explicitly: no
+-- credential has the id `*`, so the NOT EXISTS guard alone would wrongly match
+-- it. There is no tenant scope: credential ids are globally unique, so an
+-- orphaned grant is one whose id matches no credential in any tenant. This
+-- removes every action on an orphaned resource, matching the credential DELETE
+-- handler.
+--
+-- Idempotent: after this runs no orphaned row remains, so a re-run is a no-op.
+DELETE FROM "grant"
+WHERE "resource" LIKE 'credential:%'
+  AND "resource" <> 'credential:*'
+  AND NOT EXISTS (
+    SELECT 1
+    FROM "credential" c
+    WHERE c."id" = substr("grant"."resource", length('credential:') + 1)
+  );