@magnusekdahl/parallix 1.3.4 → 1.5.126

package/build/migrations/0003-board-lane-events.sql

@@ -0,0 +1,72 @@
+-- Migration: 0003-board-lane-events
+-- Description: Dedicated relational table for board lane-transition events.
+--   Replaces the JSON-blob pattern (operational_history + event_type filter)
+--   with a typed table following the usage_statistics analytical pattern.
+--
+-- Authority: operator-local telemetry only (ADR 0051). Lane-transition events
+--   are the source of truth for the event log itself, never a competing mission
+--   lifecycle authority — repository Git/Markdown state still wins.
+--
+-- Domain alignment:
+--   - mission_id maps to MissionId (src/domain/mission.ts)
+--   - from_status / to_status map to MissionStatus enum values
+--   - trigger maps to MissionCommand['type'] (src/domain/mission-workflow.ts)
+--   - agent maps to AgentFamily (src/domain/agents.ts)
+--   - occurred_at is the authoritative transition timestamp
+--   The row maps 1:1 to LaneTransitionEvent (src/domain/board-event.ts) and
+--   converts losslessly to MissionTransition via the domain mapping function.
+--
+-- Relationship to usage_statistics:
+--   board_lane_events records every lifecycle transition (the "when" and
+--   "how" of mission movement). usage_statistics records outcome measurements
+--   for completed missions (cycle time, tokens, cost, review rounds).
+--   Together they feed buildMetrics():
+--     - board_lane_events → MissionTransition[] → cumulativeFlow, wipSeries
+--     - usage_statistics  → MissionOutcome[]    → throughput, reviewLoopRate
+--   Both tables share mission_id as the join key and use the same
+--   operator-local authority model.
+--
+-- Forward-only: this migration has no `down` SQL. The TASK-2295 migration runner
+-- takes a pre-migration backup before applying an irreversible migration.
+
+CREATE TABLE IF NOT EXISTS board_lane_events (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+
+  -- Domain identity: which mission transitioned
+  mission_id TEXT NOT NULL,
+
+  -- Lifecycle states (MissionStatus vocabulary:
+  --   backlog, refined, active, review, integration, done)
+  from_status TEXT,
+  to_status TEXT NOT NULL,
+
+  -- Which MissionCommand caused the transition
+  --   (activate, submit-for-review, request-changes, approve, integrate)
+  trigger TEXT NOT NULL,
+
+  -- Agent family that performed the transition
+  agent TEXT NOT NULL DEFAULT 'unknown',
+
+  -- ISO-8601 timestamp of the authoritative transition
+  occurred_at TEXT NOT NULL,
+
+  -- Idempotency key: application-generated, unique per emission attempt.
+  -- Prevents duplicate rows if the same transition is recorded twice.
+  idempotency_key TEXT NOT NULL
+);
+
+-- Idempotency backstop: a duplicate emission of the same idempotency key
+-- cannot produce a second row. The application recorder also dedups by
+-- idempotency key before writing; this UNIQUE index makes the guarantee
+-- durable at the storage layer.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_board_lane_events_idempotency
+  ON board_lane_events (idempotency_key);
+
+-- Query-support index for reading lane transitions by mission id
+-- (used by buildMetrics → cumulativeFlow, wipSeries).
+CREATE INDEX IF NOT EXISTS idx_board_lane_events_mission
+  ON board_lane_events (mission_id, occurred_at);
+
+-- Query-support index for throughput / flow analytics by time window.
+CREATE INDEX IF NOT EXISTS idx_board_lane_events_time
+  ON board_lane_events (occurred_at);

package/build/migrations/0004-mission-aggregate.sql

@@ -0,0 +1,151 @@
+-- Migration: 0004-mission-aggregate
+-- Persist the checked Mission aggregate as relational domain data. Child
+-- tables are aggregate-owned value collections, not independently writable
+-- entities. Repository observations remain in known_repositories; missions
+-- retain only the stable RepositoryId reference.
+
+ALTER TABLE known_repositories ADD COLUMN display_name TEXT;
+
+CREATE TABLE missions (
+  id TEXT PRIMARY KEY NOT NULL,
+  repository_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (
+    status IN ('backlog', 'refined', 'active', 'review', 'integration', 'done')
+  ),
+  raw_status TEXT,
+  assignee TEXT,
+  net_engineering_lines INTEGER CHECK (
+    net_engineering_lines IS NULL OR net_engineering_lines >= 0
+  ),
+  closed_at TEXT,
+  version INTEGER NOT NULL DEFAULT 1 CHECK (version >= 1),
+  CHECK (
+    closed_at IS NULL OR status = 'done'
+  )
+);
+
+CREATE INDEX idx_missions_repository ON missions (repository_id);
+CREATE INDEX idx_missions_status ON missions (status);
+
+CREATE TABLE mission_labels (
+  mission_id TEXT NOT NULL REFERENCES missions(id) ON DELETE CASCADE,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  label TEXT NOT NULL CHECK (length(label) > 0),
+  PRIMARY KEY (mission_id, position),
+  UNIQUE (mission_id, label)
+);
+
+CREATE TABLE mission_checkpoints (
+  mission_id TEXT NOT NULL REFERENCES missions(id) ON DELETE CASCADE,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  checkpoint_mission_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  raw_filename TEXT,
+  first_line TEXT,
+  next_action_text TEXT NOT NULL,
+  PRIMARY KEY (mission_id, position)
+);
+
+CREATE TABLE mission_checkpoint_goal_checks (
+  mission_id TEXT NOT NULL,
+  checkpoint_position INTEGER NOT NULL,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  criterion TEXT NOT NULL,
+  evidence TEXT NOT NULL,
+  PRIMARY KEY (mission_id, checkpoint_position, position),
+  FOREIGN KEY (mission_id, checkpoint_position)
+    REFERENCES mission_checkpoints(mission_id, position) ON DELETE CASCADE
+);
+
+CREATE TABLE mission_reviews (
+  mission_id TEXT PRIMARY KEY REFERENCES missions(id) ON DELETE CASCADE,
+  intervention_requested_at TEXT,
+  intervention_requested_by TEXT CHECK (
+    intervention_requested_by IS NULL
+    OR intervention_requested_by IN ('reviewer', 'implementer', 'workflow')
+  ),
+  intervention_reason TEXT,
+  CHECK (
+    (intervention_requested_at IS NULL
+      AND intervention_requested_by IS NULL
+      AND intervention_reason IS NULL)
+    OR
+    (intervention_requested_at IS NOT NULL
+      AND intervention_requested_by IS NOT NULL
+      AND intervention_reason IS NOT NULL)
+  )
+);
+
+CREATE TABLE mission_review_rounds (
+  mission_id TEXT NOT NULL REFERENCES mission_reviews(mission_id) ON DELETE CASCADE,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  round_number INTEGER NOT NULL CHECK (round_number >= 1),
+  change_kind TEXT NOT NULL CHECK (change_kind IN ('pull-request', 'local-branch')),
+  provider TEXT,
+  provider_change_id TEXT,
+  provider_url TEXT,
+  source_branch TEXT NOT NULL,
+  target_branch TEXT NOT NULL,
+  revision TEXT NOT NULL,
+  reviewer TEXT NOT NULL,
+  implementer TEXT NOT NULL,
+  started_at TEXT NOT NULL,
+  decision_kind TEXT CHECK (decision_kind IS NULL OR decision_kind IN ('approved', 'changes-requested')),
+  decided_at TEXT,
+  decision_comment TEXT,
+  approval_source_kind TEXT CHECK (
+    approval_source_kind IS NULL OR approval_source_kind IN ('provider', 'local')
+  ),
+  approval_source_provider TEXT,
+  responded_at TEXT,
+  resulting_revision TEXT,
+  PRIMARY KEY (mission_id, position),
+  UNIQUE (mission_id, round_number),
+  CHECK (
+    (change_kind = 'pull-request' AND provider IS NOT NULL AND provider_change_id IS NOT NULL)
+    OR
+    (change_kind = 'local-branch' AND provider IS NULL
+      AND provider_change_id IS NULL AND provider_url IS NULL)
+  ),
+  CHECK (
+    (decision_kind IS NULL AND decided_at IS NULL AND approval_source_kind IS NULL)
+    OR
+    (decision_kind = 'approved' AND decided_at IS NOT NULL AND approval_source_kind IS NOT NULL)
+    OR
+    (decision_kind = 'changes-requested' AND decided_at IS NOT NULL
+      AND approval_source_kind IS NULL AND approval_source_provider IS NULL)
+  ),
+  CHECK (
+    (responded_at IS NULL AND resulting_revision IS NULL)
+    OR (responded_at IS NOT NULL AND resulting_revision IS NOT NULL)
+  )
+);
+
+CREATE TABLE mission_review_findings (
+  mission_id TEXT NOT NULL,
+  round_position INTEGER NOT NULL,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  finding_id TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  location TEXT,
+  PRIMARY KEY (mission_id, round_position, position),
+  UNIQUE (mission_id, round_position, finding_id),
+  FOREIGN KEY (mission_id, round_position)
+    REFERENCES mission_review_rounds(mission_id, position) ON DELETE CASCADE
+);
+
+CREATE TABLE mission_review_resolutions (
+  mission_id TEXT NOT NULL,
+  round_position INTEGER NOT NULL,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  finding_id TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('fixed', 'disputed')),
+  explanation TEXT NOT NULL,
+  PRIMARY KEY (mission_id, round_position, position),
+  UNIQUE (mission_id, round_position, finding_id),
+  FOREIGN KEY (mission_id, round_position)
+    REFERENCES mission_review_rounds(mission_id, position) ON DELETE CASCADE,
+  FOREIGN KEY (mission_id, round_position, finding_id)
+    REFERENCES mission_review_findings(mission_id, round_position, finding_id)
+);

package/build/migrations/0005-mission-external-task-ref.sql

@@ -0,0 +1,18 @@
+-- Migration: 0005-mission-external-task-ref
+-- Intake traceability for accepted external material (ADR 0053: external task
+-- catalogs are excluded as aggregates; only the reference is stored).
+--
+-- Modelled as an aggregate-owned value collection with at most one row per
+-- mission, exactly like the other nested Mission values. It deliberately has no
+-- status, assignee, or lifecycle column: a second lifecycle authority must not
+-- be reachable by adding columns to this table.
+
+CREATE TABLE mission_external_task_refs (
+  mission_id TEXT PRIMARY KEY REFERENCES missions(id) ON DELETE CASCADE,
+  source TEXT NOT NULL CHECK (length(source) > 0 AND length(source) <= 512),
+  external_id TEXT NOT NULL CHECK (length(external_id) > 0 AND length(external_id) <= 512),
+  url TEXT CHECK (url IS NULL OR (length(url) > 0 AND length(url) <= 512))
+);
+
+CREATE INDEX idx_mission_external_task_refs_source
+  ON mission_external_task_refs (source, external_id);

package/build/migrations/0005-repository-scoped-session-markers.sql

@@ -0,0 +1,47 @@
+-- Migration: 0005-repository-scoped-session-markers
+-- Description: Scope SessionMarker identity to its owning repository and make
+--   the table strict so SQLite enforces the declared storage classes.
+--
+-- Migration 0004 may already be present in an operator database. Its rows do
+-- not contain enough information to infer their repository safely, so they are
+-- preserved under an explicit legacy scope. An explicit legacy import can
+-- associate source worktree markers with a checked RepositoryId.
+
+DROP INDEX IF EXISTS idx_session_markers_mission;
+
+ALTER TABLE session_markers RENAME TO session_markers_unscoped;
+
+CREATE TABLE session_markers (
+  repository_id TEXT NOT NULL CHECK(length(trim(repository_id)) > 0),
+  mission_id TEXT NOT NULL,
+  role TEXT NOT NULL CHECK(role IN ('execute', 'draft', 'review')),
+  agent TEXT NOT NULL,
+  last_launched TEXT NOT NULL,
+  session_id TEXT,
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),
+  UNIQUE(repository_id, mission_id, role)
+) STRICT;
+
+INSERT INTO session_markers (
+  repository_id,
+  mission_id,
+  role,
+  agent,
+  last_launched,
+  session_id,
+  updated_at
+)
+SELECT
+  'legacy-unscoped',
+  mission_id,
+  role,
+  agent,
+  last_launched,
+  session_id,
+  updated_at
+FROM session_markers_unscoped;
+
+DROP TABLE session_markers_unscoped;
+
+CREATE INDEX idx_session_markers_repository_mission
+  ON session_markers (repository_id, mission_id);

package/build/migrations/0006-session-markers.sql

@@ -0,0 +1,35 @@
+-- Migration: 0006-session-markers
+-- Description: Dedicated relational table for SessionMarker domain concept.
+--   Replaces the file-backed `.workflow/sessions/<slug>-<role>.json` path as
+--   the sole live authority for resumable agent-session markers (TASK-2322.09).
+--
+-- Authority: operator-local domain state (ADR 0053 classification:
+--   `database-owned-domain-state`). Session identity must survive worktree
+--   cleanup and must not be confused with an inferred Attempt aggregate.
+--
+-- Domain alignment:
+--   - mission_id maps to MissionId (src/domain/mission.ts)
+--   - role maps to SessionRole enum ('execute' | 'draft' | 'review')
+--   - agent maps to AgentFamily (src/domain/agents.ts)
+--   - last_launched is the ISO-8601 timestamp of the last agent launch
+--   - session_id is the optional provider session identifier
+--   - updated_at is the authoritative modification timestamp
+--   The row maps 1:1 to SessionMarker (src/domain/session.ts).
+--
+-- Forward-only: this migration has no `down` SQL. The TASK-2295 migration runner
+-- takes a pre-migration backup before applying an irreversible migration.
+
+CREATE TABLE IF NOT EXISTS session_markers (
+  mission_id TEXT NOT NULL,
+  role TEXT NOT NULL CHECK(role IN ('execute', 'draft', 'review')),
+  agent TEXT NOT NULL,
+  last_launched TEXT NOT NULL,
+  session_id TEXT,
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),
+  UNIQUE(mission_id, role)
+);
+
+-- Query-support index for reading markers by mission (e.g. import dedup,
+-- bulk clear by mission, or operator-local status queries).
+CREATE INDEX IF NOT EXISTS idx_session_markers_mission
+  ON session_markers (mission_id);

package/build/migrations/0007-usage-statistics-identity.sql

@@ -0,0 +1,60 @@
+-- 0007-usage-statistics-identity
+--
+-- TASK-2322.08: make `usage_statistics` the sole authority for
+-- `AgentRunMeasurement` / `MissionOutcome` data (ADR 0053), replacing the
+-- former `<PARALLIX_HOME>/stats.csv` file authority.
+--
+-- Identity: TASK-2322.02 excluded `Attempt`, so a measurement has NO per-run
+-- identity. The valid identity is the grouping the domain already models —
+-- (repo, mission, stage, actor) — where `actor_key` is the normalized agent
+-- family the row is attributed to. `actor_key` is supplied by the caller that
+-- owns the attribution rule; the adapter never infers it, and no per-launch
+-- row is created.
+--
+-- Irreversible (no `down`): the unique index collapses pre-existing duplicate
+-- rows that the file authority allowed. The migration runner takes a
+-- pre-migration backup for irreversible migrations.
+
+ALTER TABLE usage_statistics ADD COLUMN actor_key TEXT NOT NULL DEFAULT '';
+
+-- Backfill `actor_key` with the same rule the statistics command applies:
+-- review rows are attributed to the reviewer, every other stage to the
+-- implementer; the value is trimmed, stripped of one leading '@', lowercased.
+UPDATE usage_statistics
+SET actor_key = lower(
+  CASE
+    WHEN substr(
+      CASE
+        WHEN lower(trim(COALESCE(NULLIF(trim(stage), ''), 'default'))) = 'review'
+          THEN COALESCE(NULLIF(trim(reviewer_agent), ''), NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+        ELSE COALESCE(NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+      END, 1, 1) = '@'
+    THEN substr(
+      CASE
+        WHEN lower(trim(COALESCE(NULLIF(trim(stage), ''), 'default'))) = 'review'
+          THEN COALESCE(NULLIF(trim(reviewer_agent), ''), NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+        ELSE COALESCE(NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+      END, 2)
+    ELSE
+      CASE
+        WHEN lower(trim(COALESCE(NULLIF(trim(stage), ''), 'default'))) = 'review'
+          THEN COALESCE(NULLIF(trim(reviewer_agent), ''), NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+        ELSE COALESCE(NULLIF(trim(implementer_agent), ''), NULLIF(trim(implementer), ''), '')
+      END
+  END
+);
+
+-- Normalize `stage` so the identity key cannot split on '' vs 'default'.
+UPDATE usage_statistics
+SET stage = lower(trim(COALESCE(NULLIF(trim(stage), ''), 'default')));
+
+-- Collapse duplicates the file authority permitted, keeping the newest row
+-- (highest rowid) for each identity.
+DELETE FROM usage_statistics
+WHERE id NOT IN (
+  SELECT MAX(id) FROM usage_statistics
+  GROUP BY repo, mission, stage, actor_key
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_usage_statistics_identity
+  ON usage_statistics(repo, mission, stage, actor_key);

package/build/migrations/0008-review-workflow-state.sql

@@ -0,0 +1,61 @@
+-- TASK-2322.12: model review-loop workflow state on the Review aggregate.
+--
+-- Before this migration the workflow phase, per-round retry counters and the
+-- stage-launch de-duplication windows lived only in review-state.json, which
+-- made review-state.json the durable authority for a concept ADR 0053 assigns
+-- to the operator database. These columns close that gap so the JSON path can
+-- be retired.
+--
+-- Additive only: existing rows take the defaults, which reproduce the values a
+-- pre-migration review would have had (a round with no recorded retries, in the
+-- phase implied by its decision history).
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN phase TEXT NOT NULL DEFAULT 'reviewing'
+    CHECK (phase IN ('reviewing', 'fixing', 'pending-approval', 'approved'));
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN disposition TEXT
+    CHECK (
+      disposition IS NULL
+      OR disposition IN (
+        'APPROVED', 'REQUEST_CHANGES', 'COMMENT',
+        'PUSHBACK_ALL', 'BLOCKED', 'PARKED', 'CHANGES_MADE'
+      )
+    );
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN reviewer_retry_count INTEGER NOT NULL DEFAULT 0
+    CHECK (reviewer_retry_count >= 0);
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN implementer_retry_count INTEGER NOT NULL DEFAULT 0
+    CHECK (implementer_retry_count >= 0);
+
+-- Backfill phase and disposition from the decision history already stored, so
+-- an upgraded database presents the same loop state a fresh one would.
+UPDATE mission_review_rounds
+  SET phase = 'approved', disposition = 'APPROVED'
+  WHERE decision_kind = 'approved';
+
+UPDATE mission_review_rounds
+  SET phase = 'pending-approval', disposition = 'CHANGES_MADE'
+  WHERE decision_kind = 'changes-requested' AND responded_at IS NOT NULL;
+
+UPDATE mission_review_rounds
+  SET phase = 'fixing', disposition = 'REQUEST_CHANGES'
+  WHERE decision_kind = 'changes-requested' AND responded_at IS NULL;
+
+-- Stage-launch windows are cumulative across rounds, so they hang off the
+-- review rather than a round. `position` preserves insertion order within a
+-- window; the application caps retained fingerprints per window.
+CREATE TABLE mission_review_stage_launches (
+  mission_id TEXT NOT NULL REFERENCES mission_reviews(mission_id) ON DELETE CASCADE,
+  stage_key TEXT NOT NULL,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  fingerprint TEXT NOT NULL,
+  PRIMARY KEY (mission_id, stage_key, position)
+);
+
+CREATE INDEX idx_review_stage_launches_window
+  ON mission_review_stage_launches (mission_id, stage_key);

package/build/migrations/0009-review-gate-retries.sql

@@ -0,0 +1,16 @@
+-- TASK-2322.12: carry the pre-review gate retry budget on the Review aggregate.
+--
+-- Migration 0008 modelled the workflow phase, the per-round retry counters and
+-- the stage-launch windows. It did not cover `gateFailureRetryCount`, the
+-- counter `handleGateFailureAutoBounce` uses to cap auto-bounces at
+-- MAX_GATE_RETRY. That counter is the last review-loop value that would have
+-- kept review-state.json alive as a durable authority, so it lands here rather
+-- than by rewriting 0008, which is already applied.
+--
+-- Cumulative across rounds like the stage-launch windows: an auto-bounce hands
+-- the mission back to the implementer without starting a new round, so a
+-- per-round column would reset the budget on every bounce.
+
+ALTER TABLE mission_reviews
+  ADD COLUMN gate_failure_retry_count INTEGER NOT NULL DEFAULT 0
+    CHECK (gate_failure_retry_count >= 0);

package/build/migrations/0010-review-events-and-implementer-response.sql

@@ -0,0 +1,64 @@
+-- TASK-2322.12: store review events and implementer response details in SQLite.
+--
+-- The review-events .md files (missions/<slug>/review-events/*.md) are workflow
+-- audit records that supplement the Review aggregate. After this migration they
+-- are stored in the operator database so the file-backed paths can be retired.
+--
+-- Two concerns land here:
+--
+-- 1. mission_review_events — full audit trail for all event types
+--    (reviewer findings/outcomes, implementer summaries/dispositions,
+--    human notes, blocked/parked publication records). This replaces the
+--    .md files under missions/<slug>/review-events/.
+--
+-- 2. Implementer response columns on mission_review_rounds — the implementer's
+--    round summary includes workflow metadata (fixed_items, pushed_back_items,
+--    parked_items, blocked_reason) that is not captured by the structured
+--    FindingResolution collection. These columns store that metadata directly
+--    on the round so stats.ts and the review loop can access it without
+--    scanning event files.
+--
+-- Additive only: existing rows take NULL defaults. The application backfills
+-- from .md files on first read (compatibility path).
+
+-- Full audit trail for review events (replaces missions/<slug>/review-events/*.md)
+CREATE TABLE mission_review_events (
+  mission_id TEXT NOT NULL REFERENCES mission_reviews(mission_id) ON DELETE CASCADE,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  event_type TEXT NOT NULL CHECK (
+    event_type IN (
+      'reviewer_findings', 'reviewer_outcome',
+      'implementer_round_summary', 'implementer_disposition',
+      'neutral_discussion', 'human_note',
+      'blocked_publication', 'parked_followup'
+    )
+  ),
+  round_number INTEGER CHECK (round_number IS NULL OR round_number >= 1),
+  phase TEXT,
+  actor TEXT,
+  content TEXT NOT NULL DEFAULT '',
+  disposition TEXT,
+  verdict TEXT,
+  /** JSON array of {kind: 'fixed'|'pushed_back'|'parked', findingId: string} */
+  item_dispositions TEXT,
+  blocked_reason TEXT,
+  followup_reference TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%S', 'now')),
+  PRIMARY KEY (mission_id, position)
+);
+
+CREATE INDEX idx_review_events_mission_type
+  ON mission_review_events (mission_id, event_type);
+
+CREATE INDEX idx_review_events_round
+  ON mission_review_events (mission_id, round_number);
+
+-- Implementer response metadata on the round (supplements FindingResolution)
+ALTER TABLE mission_review_rounds
+  ADD COLUMN implementer_response_content TEXT;
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN item_dispositions TEXT;
+
+ALTER TABLE mission_review_rounds
+  ADD COLUMN blocked_reason TEXT;

package/build/migrations/0011-board-lane-events-repository-id.sql

@@ -0,0 +1,89 @@
+-- Migration: 0011-board-lane-events-repository-id
+-- Description: Add repository_id to board_lane_events and scope the
+--   idempotency UNIQUE index and mission lookup index by repository.
+--   Existing rows are backfilled with the explicit 'legacy-unscoped'
+--   sentinel following the precedent in 0005-repository-scoped-session-markers.
+--
+-- Authority: operator-local telemetry only (ADR 0051).
+-- Domain alignment: repository_id maps to RepositoryId (src/domain/repository.ts).
+--
+-- Forward-only: uses rename-copy-drop pattern. The TASK-2295 migration runner
+-- takes a pre-migration backup before applying an irreversible migration.
+
+-- Drop indexes that will be recreated with repository_id prefix
+DROP INDEX IF EXISTS idx_board_lane_events_idempotency;
+DROP INDEX IF EXISTS idx_board_lane_events_mission;
+DROP INDEX IF EXISTS idx_board_lane_events_time;
+
+-- Rename existing table
+ALTER TABLE board_lane_events RENAME TO board_lane_events_unscoped;
+
+-- Create new table with repository_id and CHECK constraint
+CREATE TABLE board_lane_events (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+
+  -- Stable repository identifier (scoped, non-empty)
+  repository_id TEXT NOT NULL CHECK(length(trim(repository_id)) > 0),
+
+  -- Domain identity: which mission transitioned
+  mission_id TEXT NOT NULL,
+
+  -- Lifecycle states (MissionStatus vocabulary:
+  --   backlog, refined, active, review, integration, done)
+  from_status TEXT,
+  to_status TEXT NOT NULL,
+
+  -- Which MissionCommand caused the transition
+  --   (activate, submit-for-review, request-changes, approve, integrate)
+  trigger TEXT NOT NULL,
+
+  -- Agent family that performed the transition
+  agent TEXT NOT NULL DEFAULT 'unknown',
+
+  -- ISO-8601 timestamp of the authoritative transition
+  occurred_at TEXT NOT NULL,
+
+  -- Idempotency key: application-generated, unique per emission attempt.
+  -- Scoped by repository_id so the same key can exist in different repos.
+  idempotency_key TEXT NOT NULL
+);
+
+-- Backfill: existing rows get explicit legacy sentinel
+INSERT INTO board_lane_events (
+  id,
+  repository_id,
+  mission_id,
+  from_status,
+  to_status,
+  trigger,
+  agent,
+  occurred_at,
+  idempotency_key
+)
+SELECT
+  id,
+  'legacy-unscoped',
+  mission_id,
+  from_status,
+  to_status,
+  trigger,
+  agent,
+  occurred_at,
+  idempotency_key
+FROM board_lane_events_unscoped;
+
+-- Drop the old table
+DROP TABLE board_lane_events_unscoped;
+
+-- Idempotency: scoped by (repository_id, idempotency_key) so the same key
+-- can exist in different repositories without collision.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_board_lane_events_repo_idempotency
+  ON board_lane_events (repository_id, idempotency_key);
+
+-- Query-support index for reading lane transitions by repository + mission
+CREATE INDEX IF NOT EXISTS idx_board_lane_events_repo_mission
+  ON board_lane_events (repository_id, mission_id, occurred_at);
+
+-- Query-support index for throughput / flow analytics by time window
+CREATE INDEX IF NOT EXISTS idx_board_lane_events_time
+  ON board_lane_events (occurred_at);

package/build/migrations/0012-review-hook-retries.sql

@@ -0,0 +1,11 @@
+-- TASK-2340: carry the hook-failure retry budget on the Review aggregate.
+--
+-- Mirrors migration 0009 (gate_failure_retry_count). Hook auto-bounces happen
+-- during rebase/integrate operations, not during the pre-review gate, so the
+-- counter is separate. Cumulative across rounds like gate retries: a hook
+-- bounce hands the mission back to the implementer without starting a new
+-- round, so a per-round column would reset the budget on every bounce.
+
+ALTER TABLE mission_reviews
+  ADD COLUMN hook_failure_retry_count INTEGER NOT NULL DEFAULT 0
+    CHECK (hook_failure_retry_count >= 0);

package/build/migrations/0013-usage-statistics-thoughts-tokens.sql

@@ -0,0 +1,11 @@
+-- TASK-2362: record thinking/reasoning tokens as their own measurement column.
+--
+-- The qwen usage artifacts (`usage/token-usage-YYYY-MM.jsonl`) report
+-- `thoughtsTokens` separately from input/output/cached. Folding them into
+-- output_tokens would make the reasoning spend invisible, so they land in
+-- their own column alongside the other token categories. Families that do not
+-- report thinking tokens write 0, which is the same honest-zero the other
+-- token columns already use.
+
+ALTER TABLE usage_statistics
+  ADD COLUMN thoughts_tokens INTEGER;