@obsunified/collector 2.0.1 → 2.2.0

package/src/migrations/046_action_graph_project_composite_pk.sql

@@ -0,0 +1,255 @@
+-- Migration 046: action graph tables keyed by (project_id, id)
+--
+-- The RFC 0010 spine and leaf tables (031) used `id TEXT PRIMARY KEY`.
+-- Action ids are client-supplied (`obs.action.id`) and leaf ids are raw
+-- OTel span ids, so two projects can legitimately emit the same id. The
+-- stores upserted with ON CONFLICT(id) DO UPDATE SET project_id = ..., which
+-- let one tenant move or overwrite another tenant's row.
+--
+-- Rebuilds all six tables with PRIMARY KEY (project_id, id), preserving every
+-- row, column default and index (031, 038, 044). The old key was unique, so
+-- the composite key cannot collide. Re-running the file is a no-op in effect.
+
+-- 1. actions
+DROP TABLE IF EXISTS actions_new;
+
+CREATE TABLE actions_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  root_action_id TEXT NOT NULL,
+  caused_by_action_id TEXT,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT,
+  action_kind TEXT NOT NULL,
+  name TEXT,
+  status TEXT NOT NULL DEFAULT 'ok',
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  duration_ms INTEGER,
+  trace_id TEXT,
+  span_id TEXT,
+  session_id TEXT,
+  interaction_id TEXT,
+  user_id TEXT,
+  agent_run_id TEXT,
+  step_id TEXT,
+  tool_call_id TEXT,
+  prompt_version TEXT,
+  model_name TEXT,
+  provider TEXT,
+  total_cost_usd REAL,
+  attrs_json TEXT,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO actions_new (
+  project_id, id, root_action_id, caused_by_action_id, actor_type, actor_id,
+  action_kind, name, status, started_at, ended_at, duration_ms, trace_id,
+  span_id, session_id, interaction_id, user_id, agent_run_id, step_id,
+  tool_call_id, prompt_version, model_name, provider, total_cost_usd, attrs_json
+)
+SELECT
+  project_id, id, root_action_id, caused_by_action_id, actor_type, actor_id,
+  action_kind, name, COALESCE(status, 'ok'), started_at, ended_at, duration_ms,
+  trace_id, span_id, session_id, interaction_id, user_id, agent_run_id, step_id,
+  tool_call_id, prompt_version, model_name, provider, total_cost_usd, attrs_json
+FROM actions;
+
+DROP TABLE actions;
+
+ALTER TABLE actions_new RENAME TO actions;
+
+CREATE INDEX IF NOT EXISTS idx_actions_project_root
+  ON actions (project_id, root_action_id, started_at);
+CREATE INDEX IF NOT EXISTS idx_actions_project_actor
+  ON actions (project_id, actor_type, actor_id, started_at DESC);
+CREATE INDEX IF NOT EXISTS idx_actions_project_trace
+  ON actions (project_id, trace_id)
+  WHERE trace_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_actions_project_interaction
+  ON actions (project_id, interaction_id)
+  WHERE interaction_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_actions_project_agent_run
+  ON actions (project_id, agent_run_id, started_at)
+  WHERE agent_run_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_actions_started_at
+  ON actions (started_at);
+
+-- 2. agent_runs
+DROP TABLE IF EXISTS agent_runs_new;
+
+CREATE TABLE agent_runs_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  agent_name TEXT NOT NULL,
+  agent_version TEXT NOT NULL,
+  goal TEXT,
+  outcome TEXT,
+  autonomy_level TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'running',
+  error_message TEXT,
+  total_cost_usd REAL DEFAULT 0.0,
+  total_duration_ms INTEGER,
+  metadata_json TEXT,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO agent_runs_new (
+  project_id, id, agent_id, agent_name, agent_version, goal, outcome,
+  autonomy_level, status, error_message, total_cost_usd, total_duration_ms,
+  metadata_json
+)
+SELECT
+  project_id, id, agent_id, agent_name, agent_version, goal, outcome,
+  autonomy_level, COALESCE(status, 'running'), error_message, total_cost_usd,
+  total_duration_ms, metadata_json
+FROM agent_runs;
+
+DROP TABLE agent_runs;
+
+ALTER TABLE agent_runs_new RENAME TO agent_runs;
+
+CREATE INDEX IF NOT EXISTS idx_agent_runs_project_agent
+  ON agent_runs (project_id, agent_id, status);
+
+-- 3. tool_calls (031 columns + 038 evidence columns)
+DROP TABLE IF EXISTS tool_calls_new;
+
+CREATE TABLE tool_calls_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  args_hash TEXT NOT NULL,
+  result_hash TEXT NOT NULL,
+  error_type TEXT,
+  side_effect INTEGER NOT NULL DEFAULT 0,
+  approval_state TEXT,
+  args_redacted TEXT,
+  result_redacted TEXT,
+  mcp_audit_json TEXT,
+  mutation_before_json TEXT,
+  mutation_after_json TEXT,
+  mutation_diff_json TEXT,
+  mutation_artifact_id TEXT,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO tool_calls_new (
+  project_id, id, action_id, tool_name, args_hash, result_hash, error_type,
+  side_effect, approval_state, args_redacted, result_redacted, mcp_audit_json,
+  mutation_before_json, mutation_after_json, mutation_diff_json,
+  mutation_artifact_id
+)
+SELECT
+  project_id, id, action_id, tool_name, args_hash, result_hash, error_type,
+  COALESCE(side_effect, 0), approval_state, args_redacted, result_redacted,
+  mcp_audit_json, mutation_before_json, mutation_after_json,
+  mutation_diff_json, mutation_artifact_id
+FROM tool_calls;
+
+DROP TABLE tool_calls;
+
+ALTER TABLE tool_calls_new RENAME TO tool_calls;
+
+CREATE INDEX IF NOT EXISTS idx_tool_calls_action
+  ON tool_calls (action_id);
+CREATE INDEX IF NOT EXISTS idx_tool_calls_name
+  ON tool_calls (project_id, tool_name);
+
+-- 4. retrieval_events
+DROP TABLE IF EXISTS retrieval_events_new;
+
+CREATE TABLE retrieval_events_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  retriever_name TEXT NOT NULL,
+  query_hash TEXT NOT NULL,
+  documents_json TEXT,
+  total_results INTEGER NOT NULL DEFAULT 0,
+  max_relevance_score REAL,
+  duration_ms INTEGER,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO retrieval_events_new (
+  project_id, id, action_id, retriever_name, query_hash, documents_json,
+  total_results, max_relevance_score, duration_ms
+)
+SELECT
+  project_id, id, action_id, retriever_name, query_hash, documents_json,
+  COALESCE(total_results, 0), max_relevance_score, duration_ms
+FROM retrieval_events;
+
+DROP TABLE retrieval_events;
+
+ALTER TABLE retrieval_events_new RENAME TO retrieval_events;
+
+CREATE INDEX IF NOT EXISTS idx_retrieval_events_action
+  ON retrieval_events (action_id);
+
+-- 5. eval_results
+DROP TABLE IF EXISTS eval_results_new;
+
+CREATE TABLE eval_results_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  evaluator_name TEXT NOT NULL,
+  evaluator_version TEXT NOT NULL,
+  score REAL,
+  passed INTEGER NOT NULL DEFAULT 1,
+  reasoning TEXT,
+  rubric_json TEXT,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO eval_results_new (
+  project_id, id, action_id, evaluator_name, evaluator_version, score, passed,
+  reasoning, rubric_json
+)
+SELECT
+  project_id, id, action_id, evaluator_name, evaluator_version, score,
+  COALESCE(passed, 1), reasoning, rubric_json
+FROM eval_results;
+
+DROP TABLE eval_results;
+
+ALTER TABLE eval_results_new RENAME TO eval_results;
+
+CREATE INDEX IF NOT EXISTS idx_eval_results_action
+  ON eval_results (action_id);
+
+-- 6. artifacts
+DROP TABLE IF EXISTS artifacts_new;
+
+CREATE TABLE artifacts_new (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  artifact_name TEXT NOT NULL,
+  artifact_type TEXT NOT NULL,
+  storage_ref TEXT,
+  size_bytes INTEGER,
+  sha256_hash TEXT,
+  content_preview TEXT,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO artifacts_new (
+  project_id, id, action_id, artifact_name, artifact_type, storage_ref,
+  size_bytes, sha256_hash, content_preview
+)
+SELECT
+  project_id, id, action_id, artifact_name, artifact_type, storage_ref,
+  size_bytes, sha256_hash, content_preview
+FROM artifacts;
+
+DROP TABLE artifacts;
+
+ALTER TABLE artifacts_new RENAME TO artifacts;
+
+CREATE INDEX IF NOT EXISTS idx_artifacts_action
+  ON artifacts (action_id);

package/src/migrations/047_ai_span_payloads_project_composite_pk.sql

@@ -0,0 +1,61 @@
+-- Migration 047: ai_span_payloads composite primary key
+-- (project_id, trace_id, span_id)
+--
+-- 019 keyed the payload side table by (trace_id, span_id) only, and the
+-- processor upserted with ON CONFLICT(trace_id, span_id) DO UPDATE SET
+-- project_id = excluded.project_id. Trace and span ids are produced by the
+-- client SDK, so a second project emitting the same ids replaced the first
+-- project's prompt/completion payloads and took ownership of the row.
+--
+-- Rebuilds the table with PRIMARY KEY (project_id, trace_id, span_id),
+-- preserving every row and every index (019, 021, 031). Columns come from
+-- 019 + 021 + 027 + 031 + 032. Re-running the file is a no-op in effect.
+
+DROP TABLE IF EXISTS ai_span_payloads_new;
+
+CREATE TABLE ai_span_payloads_new (
+  project_id TEXT NOT NULL,
+  trace_id TEXT NOT NULL,
+  span_id TEXT NOT NULL,
+  span_kind TEXT NOT NULL,
+  input_json TEXT,
+  output_json TEXT,
+  received_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  session_id TEXT,
+  user_id TEXT,
+  interaction_id TEXT,
+  action_id TEXT,
+  input_hash TEXT,
+  output_hash TEXT,
+  PRIMARY KEY (project_id, trace_id, span_id)
+);
+
+INSERT INTO ai_span_payloads_new (
+  project_id, trace_id, span_id, span_kind, input_json, output_json,
+  received_at, expires_at, session_id, user_id, interaction_id, action_id,
+  input_hash, output_hash
+)
+SELECT
+  project_id, trace_id, span_id, span_kind, input_json, output_json,
+  received_at, expires_at, session_id, user_id, interaction_id, action_id,
+  input_hash, output_hash
+FROM ai_span_payloads;
+
+DROP TABLE ai_span_payloads;
+
+ALTER TABLE ai_span_payloads_new RENAME TO ai_span_payloads;
+
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_received
+  ON ai_span_payloads (received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_project
+  ON ai_span_payloads (project_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_kind
+  ON ai_span_payloads (project_id, span_kind, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_session
+  ON ai_span_payloads (project_id, session_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_user
+  ON ai_span_payloads (project_id, user_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ai_payloads_action
+  ON ai_span_payloads (project_id, action_id)
+  WHERE action_id IS NOT NULL;

package/src/migrations/048_telemetry_spans_project_composite_pk.sql

@@ -0,0 +1,92 @@
+-- Migration 048: telemetry_spans composite primary key
+-- (project_id, trace_id, span_id)
+--
+-- 001 keyed spans by (trace_id, span_id); project_id arrived in 010 without
+-- joining the key. Ingest uses INSERT OR IGNORE, so a span whose
+-- (trace_id, span_id) already existed under another project was silently
+-- dropped, and the first project to write a given id owned it for every
+-- tenant.
+--
+-- Rebuilds the table with PRIMARY KEY (project_id, trace_id, span_id),
+-- preserving every row, every column default (001, 010, 017, 022, 027, 029)
+-- and every index (001, 010, 022, 023, 027, 029). The old key was unique,
+-- so the composite key cannot collide. Re-running the file is a no-op in
+-- effect.
+--
+-- Operational note: this copies the whole spans table once. Retention keeps
+-- the table bounded, but on a busy D1 database apply it in a quiet window.
+
+DROP TABLE IF EXISTS telemetry_spans_new;
+
+CREATE TABLE telemetry_spans_new (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  trace_id TEXT NOT NULL,
+  span_id TEXT NOT NULL,
+  parent_span_id TEXT,
+  trace_state TEXT,
+  service_name TEXT,
+  scope_name TEXT,
+  scope_version TEXT,
+  span_name TEXT NOT NULL,
+  span_kind INTEGER,
+  status_code INTEGER,
+  status_message TEXT,
+  start_time TEXT NOT NULL,
+  end_time TEXT NOT NULL,
+  duration_ms REAL NOT NULL,
+  attributes_json TEXT,
+  dropped_attributes_count INTEGER NOT NULL DEFAULT 0,
+  resource_attributes_json TEXT,
+  events_json TEXT,
+  dropped_events_count INTEGER NOT NULL DEFAULT 0,
+  links_json TEXT,
+  dropped_links_count INTEGER NOT NULL DEFAULT 0,
+  received_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  session_id TEXT,
+  interaction_id TEXT,
+  telemetry_sdk_name TEXT,
+  PRIMARY KEY (project_id, trace_id, span_id)
+);
+
+INSERT INTO telemetry_spans_new (
+  project_id, trace_id, span_id, parent_span_id, trace_state, service_name,
+  scope_name, scope_version, span_name, span_kind, status_code, status_message,
+  start_time, end_time, duration_ms, attributes_json, dropped_attributes_count,
+  resource_attributes_json, events_json, dropped_events_count, links_json,
+  dropped_links_count, received_at, expires_at, session_id, interaction_id,
+  telemetry_sdk_name
+)
+SELECT
+  COALESCE(project_id, 'default'), trace_id, span_id, parent_span_id,
+  trace_state, service_name, scope_name, scope_version, span_name, span_kind,
+  status_code, status_message, start_time, end_time, duration_ms,
+  attributes_json, COALESCE(dropped_attributes_count, 0),
+  resource_attributes_json, events_json, COALESCE(dropped_events_count, 0),
+  links_json, COALESCE(dropped_links_count, 0), received_at, expires_at,
+  session_id, interaction_id, telemetry_sdk_name
+FROM telemetry_spans;
+
+DROP TABLE telemetry_spans;
+
+ALTER TABLE telemetry_spans_new RENAME TO telemetry_spans;
+
+CREATE INDEX IF NOT EXISTS idx_spans_received_at ON telemetry_spans (received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_spans_trace_id ON telemetry_spans (trace_id);
+CREATE INDEX IF NOT EXISTS idx_spans_service ON telemetry_spans (service_name);
+CREATE INDEX IF NOT EXISTS idx_spans_status ON telemetry_spans (status_code);
+CREATE INDEX IF NOT EXISTS idx_spans_root ON telemetry_spans (parent_span_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_spans_project_received ON telemetry_spans (project_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_spans_with_links
+  ON telemetry_spans (project_id, received_at DESC)
+  WHERE links_json IS NOT NULL AND links_json != '[]';
+CREATE INDEX IF NOT EXISTS idx_spans_project_service_received
+  ON telemetry_spans (project_id, service_name, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_spans_session
+  ON telemetry_spans (project_id, session_id, received_at DESC);
+CREATE INDEX IF NOT EXISTS idx_spans_interaction
+  ON telemetry_spans (project_id, interaction_id, received_at DESC)
+  WHERE interaction_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_spans_sdk_name
+  ON telemetry_spans (project_id, telemetry_sdk_name, received_at DESC)
+  WHERE telemetry_sdk_name IS NOT NULL;

package/src/migrations/049_alert_state_notified.sql

@@ -0,0 +1,17 @@
+-- Migration 049: alert_state.notified
+--
+-- The evaluator records a state transition before it notifies the rule's
+-- channels, and retries the notification on later ticks while it is still
+-- outstanding. That "outstanding" bit used to be inferred from
+-- alert_evaluations, which retention purges after 720 hours — so a state
+-- older than the retention window looked undelivered again and was re-sent
+-- every tick. The flag lives on the state row instead and is never purged.
+--
+-- Backfill: every existing row is marked delivered (DEFAULT 1). Before this
+-- column existed the evaluator only wrote a transition after the channels
+-- had accepted it, so no stored state can be awaiting a notification.
+--
+-- Re-running fails with "duplicate column name", which the D1 runner treats
+-- as already applied.
+
+ALTER TABLE alert_state ADD COLUMN notified INTEGER NOT NULL DEFAULT 1;

package/src/migrations/050_autosre_causal_ontology.sql

@@ -0,0 +1,216 @@
+-- ============================================================================
+-- Migration 050: AutoSRE Causal Ontology, Change Correlation & Incident Memory
+-- (RFC 0013)
+-- ============================================================================
+
+-- 0. Denormalize environment, version, and target_node_id onto existing tables
+--    for O(log N) cohort rate lift and cross-trace contention queries.
+ALTER TABLE telemetry_spans ADD COLUMN environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE telemetry_spans ADD COLUMN service_version TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN commit_sha TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN target_node_id TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN error_signature TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_spans_cohort_attribution
+  ON telemetry_spans (project_id, environment, service_name, service_version, received_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_spans_contention_lookup
+  ON telemetry_spans (project_id, environment, target_node_id, start_time, end_time)
+  WHERE target_node_id IS NOT NULL;
+
+ALTER TABLE actions ADD COLUMN environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE actions ADD COLUMN service_version TEXT;
+ALTER TABLE actions ADD COLUMN target_node_id TEXT;
+
+-- Extend eval_runs and add eval_case_results for verifiable PairedCounterfactualProof
+ALTER TABLE eval_runs ADD COLUMN environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE eval_runs ADD COLUMN service_version TEXT;
+ALTER TABLE eval_runs ADD COLUMN commit_sha TEXT;
+ALTER TABLE eval_runs ADD COLUMN config_digest TEXT;
+ALTER TABLE eval_runs ADD COLUMN input_payload_hash TEXT;
+ALTER TABLE eval_runs ADD COLUMN failure_fingerprint TEXT;
+
+ALTER TABLE eval_case_results ADD COLUMN input_payload_hash TEXT;
+ALTER TABLE eval_case_results ADD COLUMN failure_fingerprint TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_eval_case_results_counterfactual
+  ON eval_case_results (project_id, eval_case_id, input_payload_hash, passed);
+
+-- 1. Environment-Scoped Persistent Operational Ontology Nodes
+CREATE TABLE IF NOT EXISTS ontology_nodes (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  name TEXT NOT NULL,
+  namespace_or_endpoint TEXT NOT NULL DEFAULT 'default',
+  is_scoped_identity INTEGER NOT NULL DEFAULT 1,
+  current_version TEXT,
+  current_commit_sha TEXT,
+  current_config_digest TEXT,
+  attributes_json TEXT,
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+-- 2. Directed Operational Ontology Edges (Cycles Permitted; Handled via Tarjan SCC)
+CREATE TABLE IF NOT EXISTS ontology_edges (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  source_node_id TEXT NOT NULL,
+  predicate TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  relationship_certainty TEXT NOT NULL DEFAULT 'exact',
+  call_count INTEGER NOT NULL DEFAULT 0,
+  error_count INTEGER NOT NULL DEFAULT 0,
+  last_duration_ms REAL,
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_edges_source
+  ON ontology_edges (project_id, environment, source_node_id);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_edges_target
+  ON ontology_edges (project_id, environment, target_node_id);
+
+-- 3. Explicit & Inferred Change Events
+CREATE TABLE IF NOT EXISTS change_events (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  source TEXT NOT NULL,
+  relationship_certainty TEXT NOT NULL DEFAULT 'exact',
+  summary TEXT NOT NULL,
+  service_name TEXT,
+  version TEXT,
+  previous_version TEXT,
+  commit_sha TEXT,
+  previous_commit_sha TEXT,
+  config_digest TEXT,
+  repository_url TEXT,
+  pull_request_url TEXT,
+  actor_id TEXT,
+  caused_by_action_id TEXT,
+  agent_run_id TEXT,
+  touched_paths_json TEXT,
+  attributes_json TEXT,
+  occurred_at TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_change_events_node_time
+  ON change_events (project_id, environment, target_node_id, occurred_at DESC);
+
+-- 4. Durable Incident Investigations & Runner Lease Coordination
+CREATE TABLE IF NOT EXISTS incident_investigations (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  dedup_key TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'open',
+  target_node_id TEXT NOT NULL,
+  symptom_anchor_kind TEXT NOT NULL,
+  symptom_anchor_id TEXT NOT NULL,
+  symptom_fingerprint TEXT,
+  alert_count INTEGER NOT NULL DEFAULT 1,
+  latest_bundle_json TEXT,
+  lease_owner_id TEXT,
+  lease_expires_at TEXT,
+  dispatch_attempts INTEGER NOT NULL DEFAULT 0,
+  last_dispatched_at TEXT,
+  opened_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  resolved_at TEXT,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_incidents_active_dedup
+  ON incident_investigations (project_id, environment, dedup_key, status);
+
+-- 5. Closed-Loop Investigation Findings (Separating Recovery vs Causal Proof)
+CREATE TABLE IF NOT EXISTS investigation_findings (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  incident_id TEXT,
+  fingerprint TEXT NOT NULL,
+  fingerprint_input_json TEXT NOT NULL,
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  causal_proof_tier TEXT NOT NULL DEFAULT 'unverified_locus',
+  confidence REAL NOT NULL,
+  confidence_breakdown_json TEXT NOT NULL,
+  symptom_entity_kind TEXT NOT NULL,
+  symptom_entity_id TEXT NOT NULL,
+  fault_locus_entity_kind TEXT NOT NULL,
+  fault_locus_entity_id TEXT NOT NULL,
+  root_cause_entity_kind TEXT,
+  root_cause_entity_id TEXT,
+  contributing_change_id TEXT,
+  cohort_verdict TEXT,
+  contending_trace_id TEXT,
+  causal_chain_json TEXT NOT NULL,
+  cited_evidence_ids_json TEXT NOT NULL,
+  code_references_json TEXT,
+  counterfactual_proof_json TEXT,
+  recovery_status TEXT NOT NULL DEFAULT 'not_applicable',
+  causal_verification_status TEXT NOT NULL DEFAULT 'unverified',
+  watchdog_step INTEGER NOT NULL DEFAULT 0,
+  baseline_request_rate_per_min REAL,
+  next_watchdog_check_at TEXT,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  agent_run_id TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint
+  ON investigation_findings (project_id, environment, fingerprint, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_findings_watchdog
+  ON investigation_findings (project_id, recovery_status, next_watchdog_check_at);
+
+-- 6. Pre-Execution Remediation Proposals & Single-Use Grants
+CREATE TABLE IF NOT EXISTS remediation_proposals (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  incident_id TEXT NOT NULL,
+  finding_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  action_kind TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  expected_current_state_json TEXT NOT NULL,
+  desired_target_state_json TEXT NOT NULL,
+  requested_autonomy TEXT NOT NULL,
+  effective_autonomy TEXT NOT NULL,
+  policy_decision_reason TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'proposed',
+  grant_token_hash TEXT,
+  grant_expires_at TEXT,
+  approved_by_user_id TEXT,
+  approved_at TEXT,
+  claimed_by_runner_id TEXT,
+  claimed_at TEXT,
+  claim_expires_at TEXT,
+  remediation_agent_run_id TEXT,
+  resulting_change_id TEXT,
+  failure_reason TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id),
+  UNIQUE (project_id, environment, idempotency_key)
+);