@massa-ai/core 1.2.1

package/prisma/migrations/20260720210000_repair_hook_attribution/migration.sql

@@ -0,0 +1,256 @@
+-- Hook Attribution Repair (M45+M47 / HAR-08)
+--
+-- One-shot, idempotent repair of historical hook-attribution drift: rows whose
+-- project_id is 'default' or no longer a live (or alias-target) workspace are
+-- re-derived from their payload cwd via path-deduplicated containment, and
+-- memories are re-derived via unambiguous session linkage. Broad root '/' and
+-- roots shared by more than one project_id are excluded so only UNAMBIGUOUS
+-- matches are applied. The pre-repair project id is preserved inside
+-- payload_json / metadata so the change is reversible.
+--
+-- Idempotent: repaired rows carry attribution_source='repaired' and a live
+-- project_id, so the candidate predicate excludes them on re-run. The DO $$
+-- block self-verifies the post-state and raises if any repaired id is not live
+-- or any pre-repair id was not preserved.
+--
+-- NULL-safety: every "unknown id" test uses NOT EXISTS over the live/alias set,
+-- never NOT IN over a nullable subquery.
+
+BEGIN;
+
+-- ---------------------------------------------------------------------------
+-- Live id set (workspace + alias target). Targets are FK-bound to workspaces,
+-- so the UNION is belt-and-suspenders for the "live-or-alias" language.
+-- ---------------------------------------------------------------------------
+
+-- (inlined per query; no temp/view to keep the migration self-contained)
+
+-- ---------------------------------------------------------------------------
+-- 1. Observation repair: re-derive project_id from payload.cwd via containment
+--    against path-deduplicated, unambiguous live roots (broad '/' excluded).
+-- ---------------------------------------------------------------------------
+
+WITH roots AS (
+  SELECT project_path, project_id
+  FROM workspaces
+  WHERE project_path IS NOT NULL
+    AND project_path <> '/'
+    AND project_path <> ''
+),
+-- A path shared by >1 project_id is ambiguous at the containment tier and is
+-- excluded. (Self-match is an explicit-tier concern; repair has no caller id.)
+path_count AS (
+  SELECT project_path, COUNT(DISTINCT project_id) AS n
+  FROM roots
+  GROUP BY project_path
+),
+deduped AS (
+  SELECT r.project_path, r.project_id
+  FROM roots r
+  JOIN path_count pc ON pc.project_path = r.project_path
+  WHERE pc.n = 1
+),
+candidates AS (
+  SELECT
+    o.id,
+    o.project_id AS old_id,
+    (o.payload_json::jsonb)->>'cwd' AS cwd
+  FROM observations o
+  WHERE (o.payload_json::jsonb)->>'cwd' IS NOT NULL
+    -- Never touch rows already repaired (preserves _pre_repair_project_id).
+    AND o.attribution_source IS DISTINCT FROM 'repaired'
+    AND (
+      o.project_id = 'default'
+      OR NOT EXISTS (
+        SELECT 1 FROM workspaces w WHERE w.project_id = o.project_id
+        UNION ALL
+        SELECT 1 FROM project_identity_aliases a WHERE a.target_project_id = o.project_id
+      )
+    )
+),
+matches AS (
+  SELECT
+    c.id,
+    c.old_id,
+    c.cwd,
+    d.project_id AS new_id,
+    length(d.project_path) AS plen
+  FROM candidates c
+  JOIN deduped d
+    ON c.cwd = d.project_path OR starts_with(c.cwd, d.project_path || '/')
+),
+-- rn = longest match per candidate; tie = how many distinct paths share that
+-- candidate's longest length. rn=1 AND tie=1 ⇒ unambiguous longest match.
+ranked AS (
+  SELECT
+    id,
+    old_id,
+    new_id,
+    plen,
+    ROW_NUMBER() OVER (PARTITION BY id ORDER BY plen DESC) AS rn,
+    COUNT(*) OVER (PARTITION BY id, plen) AS tie
+  FROM matches
+),
+winners AS (
+  SELECT id, old_id, new_id
+  FROM ranked
+  WHERE rn = 1 AND tie = 1
+)
+UPDATE observations
+SET
+  project_id = winners.new_id,
+  attribution_source = 'repaired',
+  payload_json = jsonb_set(
+    payload_json::jsonb,
+    '{_pre_repair_project_id}',
+    to_jsonb(winners.old_id),
+    true
+  )::text
+FROM winners
+WHERE observations.id = winners.id;
+
+-- ---------------------------------------------------------------------------
+-- 2. Memory repair: re-derive via UNAMBIGUOUS session linkage — a memory's
+--    session must yield exactly one distinct live-or-repaired project id across
+--    its observations.
+-- ---------------------------------------------------------------------------
+
+WITH mem_candidates AS (
+  SELECT
+    m.id,
+    m.project_id AS old_id,
+    m.session_id
+  FROM memories m
+  WHERE m.session_id IS NOT NULL
+    AND (m.metadata IS NULL OR NOT (m.metadata::jsonb ? '_pre_repair_project_id'))
+    AND (
+      m.project_id IS NULL
+      OR m.project_id = 'default'
+      OR NOT EXISTS (
+        SELECT 1 FROM workspaces w WHERE w.project_id = m.project_id
+        UNION ALL
+        SELECT 1 FROM project_identity_aliases a WHERE a.target_project_id = m.project_id
+      )
+    )
+),
+-- Distinct (session, project) targets observed to be live or repaired.
+session_targets AS (
+  SELECT o.session_id, o.project_id
+  FROM observations o
+  WHERE o.session_id IS NOT NULL
+    AND (
+      EXISTS (SELECT 1 FROM workspaces w WHERE w.project_id = o.project_id)
+      OR o.attribution_source = 'repaired'
+    )
+  GROUP BY o.session_id, o.project_id
+),
+unambiguous AS (
+  SELECT session_id
+  FROM session_targets
+  GROUP BY session_id
+  HAVING COUNT(DISTINCT project_id) = 1
+),
+winners AS (
+  SELECT
+    mc.id,
+    mc.old_id,
+    st.project_id AS new_id
+  FROM mem_candidates mc
+  JOIN unambiguous u ON u.session_id = mc.session_id
+  JOIN session_targets st ON st.session_id = mc.session_id
+)
+UPDATE memories
+SET
+  project_id = winners.new_id,
+  metadata = jsonb_set(
+    COALESCE(memories.metadata::jsonb, '{}'::jsonb),
+    '{_pre_repair_project_id}',
+    COALESCE(to_jsonb(winners.old_id), 'null'::jsonb),
+    true
+  )::text
+FROM winners
+WHERE memories.id = winners.id;
+
+-- ---------------------------------------------------------------------------
+-- 3. Self-verification: every repaired id is live; every pre-repair id was
+--    preserved. Counts surface the unrepairable residue (ambiguous / no cwd).
+-- ---------------------------------------------------------------------------
+
+DO $$
+DECLARE
+  n_obs_repaired    int;
+  n_obs_remaining   int;
+  n_mem_repaired    int;
+  n_mem_remaining   int;
+BEGIN
+  SELECT count(*) INTO n_obs_repaired
+  FROM observations WHERE attribution_source = 'repaired';
+
+  SELECT count(*) INTO n_obs_remaining
+  FROM observations o
+  WHERE o.attribution_source IS DISTINCT FROM 'repaired'
+    AND (
+      o.project_id = 'default'
+      OR NOT EXISTS (
+        SELECT 1 FROM workspaces w WHERE w.project_id = o.project_id
+        UNION ALL
+        SELECT 1 FROM project_identity_aliases a WHERE a.target_project_id = o.project_id
+      )
+    );
+
+  SELECT count(*) INTO n_mem_repaired
+  FROM memories m
+  WHERE m.metadata IS NOT NULL AND m.metadata::jsonb ? '_pre_repair_project_id';
+
+  SELECT count(*) INTO n_mem_remaining
+  FROM memories m
+  WHERE (m.metadata IS NULL OR NOT (m.metadata::jsonb ? '_pre_repair_project_id'))
+    AND (
+      m.project_id IS NULL
+      OR m.project_id = 'default'
+      OR NOT EXISTS (
+        SELECT 1 FROM workspaces w WHERE w.project_id = m.project_id
+        UNION ALL
+        SELECT 1 FROM project_identity_aliases a WHERE a.target_project_id = m.project_id
+      )
+    );
+
+  RAISE NOTICE 'hook_attribution_repair: observations repaired=% remaining=%',
+    n_obs_repaired, n_obs_remaining;
+  RAISE NOTICE 'hook_attribution_repair: memories repaired=% remaining=%',
+    n_mem_repaired, n_mem_remaining;
+
+  -- Invariant 1: every repaired observation points at a live workspace.
+  IF EXISTS (
+    SELECT 1 FROM observations o
+    WHERE o.attribution_source = 'repaired'
+      AND NOT EXISTS (SELECT 1 FROM workspaces w WHERE w.project_id = o.project_id)
+  ) THEN
+    RAISE EXCEPTION 'hook_attribution_repair_observation_non_live';
+  END IF;
+
+  -- Invariant 2: every repaired observation preserved its pre-repair id.
+  IF EXISTS (
+    SELECT 1 FROM observations o
+    WHERE o.attribution_source = 'repaired'
+      AND NOT ((o.payload_json::jsonb) ? '_pre_repair_project_id')
+  ) THEN
+    RAISE EXCEPTION 'hook_attribution_repair_observation_missing_pre_repair';
+  END IF;
+
+  -- Invariant 3: every repaired memory points at a live workspace.
+  IF EXISTS (
+    SELECT 1 FROM memories m
+    WHERE m.metadata IS NOT NULL
+      AND m.metadata::jsonb ? '_pre_repair_project_id'
+      AND NOT EXISTS (SELECT 1 FROM workspaces w WHERE w.project_id = m.project_id)
+  ) THEN
+    RAISE EXCEPTION 'hook_attribution_repair_memory_non_live';
+  END IF;
+
+  -- (Unrepairable residue — ambiguous paths, multi-id sessions, rows with no
+  -- cwd — is contract-legal and reported via the NOTICE counts above, not an
+  -- error. There is no further structural invariant to check.)
+END $$;
+
+COMMIT;

package/prisma/migrations/20260722120000_add_managed_runs/migration.sql

@@ -0,0 +1,66 @@
+-- Wave 5 M-W5-01 — managed_runs (FR-08 / AD-W5-004 / AD-W5-013 / AD-W5-014)
+--
+-- Single table unifying indexing lease (CAS, 90s expiry + 30s heartbeat) and
+-- idempotent event_id dedup + FileCursor resume (FR-09 / FR-10). Mirrors the
+-- proven graph_generations lease pattern (Wave 3 MLTS-011) but decoupled from
+-- the immutable snapshot row (AD-W5-004): an indexing run is a process-writer
+-- concept with a different lifecycle than a generation snapshot.
+--
+-- Reaper (AD-W5-013): every begin() first UPDATEs expired active rows to
+-- 'aborted'. The managed_runs_status_active partial index supports that
+-- reaper query (status='active' filter).
+--
+-- getActive pin (AD-W5-014): WHERE status='active' AND lease_expires_at >
+-- clock_timestamp() ORDER BY lease_expires_at DESC LIMIT 1. The
+-- managed_runs_one_active_per_project_kind partial UNIQUE index enforces "one
+-- live active row per (project_id, run_kind)" so concurrent begin() calls
+-- cannot both acquire.
+--
+-- event_id uniqueness (FR-10): UNIQUE(project_id, event_id) prevents duplicate
+-- application across crashes/restarts (idempotent incremental import).
+
+BEGIN;
+
+CREATE TABLE "managed_runs" (
+  "id" BIGSERIAL PRIMARY KEY,
+  "project_id" TEXT NOT NULL,
+  "run_kind" TEXT NOT NULL CHECK ("run_kind" IN ('indexing', 'reindex', 'maintenance')),
+  "event_id" TEXT NOT NULL,
+  "content_hash" TEXT,
+  "file_cursor" JSONB,
+  "status" TEXT NOT NULL DEFAULT 'active' CHECK ("status" IN ('active', 'completed', 'failed', 'aborted')),
+  "lease_token" TEXT,
+  "lease_expires_at" TIMESTAMPTZ,
+  "heartbeat_at" TIMESTAMPTZ,
+  "created_at" BIGINT NOT NULL,
+  "completed_at" BIGINT,
+  CONSTRAINT "managed_runs_lease_pair_check" CHECK (("lease_token" IS NULL) = ("lease_expires_at" IS NULL))
+);
+
+-- FR-10: idempotent event_id — one committed row per (project_id, event_id).
+CREATE UNIQUE INDEX "managed_runs_event_unique"
+  ON "managed_runs" ("project_id", "event_id");
+
+-- AD-W5-014: one ACTIVE row per (project_id, run_kind). Partial unique on
+-- `status='active'` only — `clock_timestamp()` is not allowed in an index
+-- predicate (PostgreSQL requires IMMUTABLE functions). Stale-but-active
+-- rows (orphaned by SIGKILL) remain in this index, so begin() MUST first run
+-- the reaper (AD-W5-013: UPDATE expired active→aborted) inside the same
+-- transaction before the INSERT. That keeps the partial unique satisfiable
+-- for the new row while still enforcing "at most one live active row" once
+-- the reaper has cleared the stale entry. getActive() then filters by
+-- `lease_expires_at > clock_timestamp()` at query time (AD-W5-014 pin).
+CREATE UNIQUE INDEX "managed_runs_one_active_per_project_kind"
+  ON "managed_runs" ("project_id", "run_kind")
+  WHERE "status" = 'active';
+
+-- Lease expiry lookup (reaper + heartbeat queries).
+CREATE INDEX "managed_runs_lease_expiry"
+  ON "managed_runs" ("lease_expires_at") WHERE "lease_expires_at" IS NOT NULL;
+
+-- AD-W5-013: reaper index. begin() UPDATEs expired active rows to 'aborted';
+-- this partial index makes that UPDATE fast even with many historical rows.
+CREATE INDEX "managed_runs_status_active"
+  ON "managed_runs" ("project_id", "run_kind", "status") WHERE "status" = 'active';
+
+COMMIT;

package/prisma/migrations/20260722130000_add_scheduler_last_success/migration.sql

@@ -0,0 +1,24 @@
+-- Wave 5 M-W5-02 — scheduler last_success_at + crash-safe catch-up (FR-13)
+--
+-- Additive nullable columns on scheduled_jobs so the scheduler can split
+-- success/failure state (currently only last_run_at, written unconditionally).
+--
+-- last_success_at  BIGINT?  — ms-epoch of the last SUCCESSFUL run (NULL until
+--                             the first success; resets the "stale since" signal).
+-- last_failure_at  BIGINT?  — ms-epoch of the last FAILED run (NULL until the
+--                             first failure).
+-- consecutive_failures INT NOT NULL DEFAULT 0 — failure streak counter.
+--                             Reset to 0 on success; incremented on failure.
+-- last_error       TEXT?    — truncated error message from the last failure
+--                             (NULL when the last run succeeded).
+--
+-- NULL-safe: existing rows get NULL for the timestamp columns and 0 for the
+-- counter. No data migration needed — the columns are additive. The scheduler
+-- (T20) updates success→last_success_at + consecutive_failures=0, failure→
+-- last_failure_at + consecutive_failures++ + last_error (truncated).
+
+ALTER TABLE "scheduled_jobs"
+  ADD COLUMN IF NOT EXISTS "last_success_at" BIGINT,
+  ADD COLUMN IF NOT EXISTS "last_failure_at" BIGINT,
+  ADD COLUMN IF NOT EXISTS "consecutive_failures" INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS "last_error" TEXT;

package/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"