@obsunified/collector 2.0.1 → 2.2.0

package/src/migrations-postgres/042_session_replay_project_composite_pk.sql

@@ -0,0 +1,16 @@
+-- Migration 042: session replay composite primary key (project_id, session_id)
+--
+-- Fixes cross-project session replay metadata collisions. Previously,
+-- session_replay_metadata used session_id alone as primary key while
+-- project_id was added in migration 010. Replay receiver upserts used
+-- ON CONFLICT(session_id), causing identical session IDs from different
+-- projects to overwrite or increment each other.
+--
+-- This forward migration drops the existing single-column primary key constraint
+-- and establishes PRIMARY KEY (project_id, session_id) while preserving all
+-- existing rows and indexes.
+
+UPDATE session_replay_metadata SET project_id = 'default' WHERE project_id IS NULL;
+ALTER TABLE session_replay_metadata ALTER COLUMN project_id SET NOT NULL;
+ALTER TABLE session_replay_metadata DROP CONSTRAINT IF EXISTS session_replay_metadata_pkey;
+ALTER TABLE session_replay_metadata ADD PRIMARY KEY (project_id, session_id);

package/src/migrations-postgres/043_metric_exemplars_text_timestamps.sql

@@ -0,0 +1,47 @@
+-- Convert metric_exemplars.received_at / expires_at from TIMESTAMPTZ to TEXT
+-- on databases migrated with the original Postgres 035.
+--
+-- Every other retention table stores timestamps as TEXT holding
+-- Date#toISOString() output, and postgresDialect renders now() as ISO text
+-- (to_char(..., 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')). Against TIMESTAMPTZ
+-- columns MetricsStore.purgeExpired failed with
+--   operator does not exist: timestamp with time zone < text
+-- so metric exemplars were never purged on Postgres.
+--
+-- Existing rows are preserved: each value is rendered in UTC in the exact
+-- shape the collector writes (millisecond precision, trailing "Z"), so the
+-- converted text compares correctly against freshly ingested rows and the
+-- dialect's now(). idx_metric_exemplars_expires is rebuilt by Postgres as
+-- part of the type change.
+--
+-- Fresh installs already create both columns as TEXT in 035 and this is a
+-- no-op. Re-running is also a no-op.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'metric_exemplars'
+      AND column_name = 'received_at'
+      AND data_type = 'timestamp with time zone'
+  ) THEN
+    ALTER TABLE metric_exemplars
+      ALTER COLUMN received_at TYPE TEXT
+      USING to_char(received_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"');
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'metric_exemplars'
+      AND column_name = 'expires_at'
+      AND data_type = 'timestamp with time zone'
+  ) THEN
+    ALTER TABLE metric_exemplars
+      ALTER COLUMN expires_at TYPE TEXT
+      USING to_char(expires_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"');
+  END IF;
+END
+$$;

package/src/migrations-postgres/044_actions_started_at_index.sql

@@ -0,0 +1,8 @@
+-- RFC 0010 — action graph retention.
+--
+-- Mirrors ../migrations/044_actions_started_at_index.sql. `started_at` is
+-- ISO-8601 TEXT on both backends, so the retention sweep compares it against
+-- a text cutoff rendered the same way `postgresDialect.sinceHours` does.
+
+CREATE INDEX IF NOT EXISTS idx_actions_started_at
+  ON actions (started_at);

package/src/migrations-postgres/045_user_profiles_project_composite_pk.sql

@@ -0,0 +1,33 @@
+-- Migration 045: user_profiles composite primary key (project_id, user_id)
+--
+-- Mirrors ../migrations/045_user_profiles_project_composite_pk.sql. The 006
+-- table used `user_id TEXT PRIMARY KEY`; 010 added project_id outside the
+-- key, so /v1/identify's ON CONFLICT(user_id) upsert let one project rewrite
+-- another project's profile. Swaps the key for (project_id, user_id) in
+-- place, keeping every row and index. The old key was unique, so the
+-- composite key cannot collide.
+--
+-- Idempotent: the block looks up the current primary key by definition and
+-- does nothing when it is already (project_id, user_id).
+
+UPDATE user_profiles SET project_id = 'default' WHERE project_id IS NULL;
+ALTER TABLE user_profiles ALTER COLUMN project_id SET NOT NULL;
+
+DO $$
+DECLARE
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  SELECT c.conname, pg_get_constraintdef(c.oid)
+    INTO pk_name, pk_def
+    FROM pg_constraint c
+   WHERE c.conrelid = 'user_profiles'::regclass AND c.contype = 'p';
+
+  IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, user_id)' THEN
+    IF pk_name IS NOT NULL THEN
+      EXECUTE format('ALTER TABLE user_profiles DROP CONSTRAINT %I', pk_name);
+    END IF;
+    ALTER TABLE user_profiles ADD PRIMARY KEY (project_id, user_id);
+  END IF;
+END
+$$;

package/src/migrations-postgres/046_action_graph_project_composite_pk.sql

@@ -0,0 +1,39 @@
+-- Migration 046: action graph tables keyed by (project_id, id)
+--
+-- Mirrors ../migrations/046_action_graph_project_composite_pk.sql. The 031
+-- spine and leaf tables used `id TEXT PRIMARY KEY`; action ids are
+-- client-supplied and leaf ids are raw OTel span ids, so two projects can
+-- emit the same id and the ON CONFLICT(id) upserts let one tenant overwrite
+-- another's row. Swaps each key for (project_id, id) in place, keeping every
+-- row and index (031, 038, 044). The old keys were unique, so the composite
+-- keys cannot collide.
+--
+-- Idempotent: each table is skipped when its primary key is already
+-- (project_id, id).
+
+DO $$
+DECLARE
+  t TEXT;
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  FOREACH t IN ARRAY ARRAY[
+    'actions', 'agent_runs', 'tool_calls', 'retrieval_events',
+    'eval_results', 'artifacts'
+  ] LOOP
+    pk_name := NULL;
+    pk_def := NULL;
+    SELECT c.conname, pg_get_constraintdef(c.oid)
+      INTO pk_name, pk_def
+      FROM pg_constraint c
+     WHERE c.conrelid = t::regclass AND c.contype = 'p';
+
+    IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, id)' THEN
+      IF pk_name IS NOT NULL THEN
+        EXECUTE format('ALTER TABLE %I DROP CONSTRAINT %I', t, pk_name);
+      END IF;
+      EXECUTE format('ALTER TABLE %I ADD PRIMARY KEY (project_id, id)', t);
+    END IF;
+  END LOOP;
+END
+$$;

package/src/migrations-postgres/047_ai_span_payloads_project_composite_pk.sql

@@ -0,0 +1,30 @@
+-- Migration 047: ai_span_payloads composite primary key
+-- (project_id, trace_id, span_id)
+--
+-- Mirrors ../migrations/047_ai_span_payloads_project_composite_pk.sql. 019
+-- keyed the payload side table by (trace_id, span_id) only; the processor's
+-- ON CONFLICT(trace_id, span_id) upsert let a second project replace the
+-- first project's prompt/completion payloads. Swaps the key for
+-- (project_id, trace_id, span_id) in place, keeping every row and index.
+-- The old key was unique, so the composite key cannot collide.
+--
+-- Idempotent: does nothing when the key is already composite.
+
+DO $$
+DECLARE
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  SELECT c.conname, pg_get_constraintdef(c.oid)
+    INTO pk_name, pk_def
+    FROM pg_constraint c
+   WHERE c.conrelid = 'ai_span_payloads'::regclass AND c.contype = 'p';
+
+  IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, trace_id, span_id)' THEN
+    IF pk_name IS NOT NULL THEN
+      EXECUTE format('ALTER TABLE ai_span_payloads DROP CONSTRAINT %I', pk_name);
+    END IF;
+    ALTER TABLE ai_span_payloads ADD PRIMARY KEY (project_id, trace_id, span_id);
+  END IF;
+END
+$$;

package/src/migrations-postgres/048_telemetry_spans_project_composite_pk.sql

@@ -0,0 +1,37 @@
+-- Migration 048: telemetry_spans composite primary key
+-- (project_id, trace_id, span_id)
+--
+-- Mirrors ../migrations/048_telemetry_spans_project_composite_pk.sql. 001
+-- keyed spans by (trace_id, span_id); 010 added project_id outside the key,
+-- so ingest's INSERT OR IGNORE (ON CONFLICT DO NOTHING here) silently
+-- dropped a span whose ids already existed under another project. Swaps the
+-- key for (project_id, trace_id, span_id) in place, keeping every row and
+-- index. The old key was unique, so the composite key cannot collide.
+--
+-- Idempotent: does nothing when the key is already composite.
+--
+-- Operational note: ADD PRIMARY KEY builds a new unique index under an
+-- ACCESS EXCLUSIVE lock. Retention keeps the table bounded, but on a busy
+-- database apply it in a quiet window.
+
+UPDATE telemetry_spans SET project_id = 'default' WHERE project_id IS NULL;
+ALTER TABLE telemetry_spans ALTER COLUMN project_id SET NOT NULL;
+
+DO $$
+DECLARE
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  SELECT c.conname, pg_get_constraintdef(c.oid)
+    INTO pk_name, pk_def
+    FROM pg_constraint c
+   WHERE c.conrelid = 'telemetry_spans'::regclass AND c.contype = 'p';
+
+  IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, trace_id, span_id)' THEN
+    IF pk_name IS NOT NULL THEN
+      EXECUTE format('ALTER TABLE telemetry_spans DROP CONSTRAINT %I', pk_name);
+    END IF;
+    ALTER TABLE telemetry_spans ADD PRIMARY KEY (project_id, trace_id, span_id);
+  END IF;
+END
+$$;

package/src/migrations-postgres/049_alert_state_notified.sql

@@ -0,0 +1,10 @@
+-- Migration 049: alert_state.notified
+--
+-- Mirrors ../migrations/049_alert_state_notified.sql. INTEGER 0/1 like the
+-- sibling alert_evaluations.notified (not BOOLEAN), so the shared store SQL
+-- can test and set it the same way on both backends.
+--
+-- Backfill: existing rows default to 1 (delivered); the pre-049 evaluator
+-- only stored a transition after the channels accepted it. Idempotent.
+
+ALTER TABLE alert_state ADD COLUMN IF NOT EXISTS notified INTEGER NOT NULL DEFAULT 1;

package/src/migrations-postgres/050_autosre_causal_ontology.sql

@@ -0,0 +1,216 @@
+-- ============================================================================
+-- Migration 050: AutoSRE Causal Ontology, Change Correlation & Incident Memory
+-- (RFC 0013 — PostgreSQL mirror)
+-- ============================================================================
+
+-- 0. Denormalize environment, version, and target_node_id onto existing tables
+--    for O(log N) cohort rate lift and cross-trace contention queries.
+ALTER TABLE telemetry_spans ADD COLUMN IF NOT EXISTS environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE telemetry_spans ADD COLUMN IF NOT EXISTS service_version TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN IF NOT EXISTS commit_sha TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN IF NOT EXISTS target_node_id TEXT;
+ALTER TABLE telemetry_spans ADD COLUMN IF NOT EXISTS error_signature TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_spans_cohort_attribution
+  ON telemetry_spans (project_id, environment, service_name, service_version, received_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_spans_contention_lookup
+  ON telemetry_spans (project_id, environment, target_node_id, start_time, end_time)
+  WHERE target_node_id IS NOT NULL;
+
+ALTER TABLE actions ADD COLUMN IF NOT EXISTS environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE actions ADD COLUMN IF NOT EXISTS service_version TEXT;
+ALTER TABLE actions ADD COLUMN IF NOT EXISTS target_node_id TEXT;
+
+-- Extend eval_runs and add eval_case_results for verifiable PairedCounterfactualProof
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS environment TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS service_version TEXT;
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS commit_sha TEXT;
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS config_digest TEXT;
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS input_payload_hash TEXT;
+ALTER TABLE eval_runs ADD COLUMN IF NOT EXISTS failure_fingerprint TEXT;
+
+ALTER TABLE eval_case_results ADD COLUMN IF NOT EXISTS input_payload_hash TEXT;
+ALTER TABLE eval_case_results ADD COLUMN IF NOT EXISTS failure_fingerprint TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_eval_case_results_counterfactual
+  ON eval_case_results (project_id, eval_case_id, input_payload_hash, passed);
+
+-- 1. Environment-Scoped Persistent Operational Ontology Nodes
+CREATE TABLE IF NOT EXISTS ontology_nodes (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  name TEXT NOT NULL,
+  namespace_or_endpoint TEXT NOT NULL DEFAULT 'default',
+  is_scoped_identity INTEGER NOT NULL DEFAULT 1,
+  current_version TEXT,
+  current_commit_sha TEXT,
+  current_config_digest TEXT,
+  attributes_json TEXT,
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+-- 2. Directed Operational Ontology Edges (Cycles Permitted; Handled via Tarjan SCC)
+CREATE TABLE IF NOT EXISTS ontology_edges (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  source_node_id TEXT NOT NULL,
+  predicate TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  relationship_certainty TEXT NOT NULL DEFAULT 'exact',
+  call_count INTEGER NOT NULL DEFAULT 0,
+  error_count INTEGER NOT NULL DEFAULT 0,
+  last_duration_ms DOUBLE PRECISION,
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_edges_source
+  ON ontology_edges (project_id, environment, source_node_id);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_edges_target
+  ON ontology_edges (project_id, environment, target_node_id);
+
+-- 3. Explicit & Inferred Change Events
+CREATE TABLE IF NOT EXISTS change_events (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  source TEXT NOT NULL,
+  relationship_certainty TEXT NOT NULL DEFAULT 'exact',
+  summary TEXT NOT NULL,
+  service_name TEXT,
+  version TEXT,
+  previous_version TEXT,
+  commit_sha TEXT,
+  previous_commit_sha TEXT,
+  config_digest TEXT,
+  repository_url TEXT,
+  pull_request_url TEXT,
+  actor_id TEXT,
+  caused_by_action_id TEXT,
+  agent_run_id TEXT,
+  touched_paths_json TEXT,
+  attributes_json TEXT,
+  occurred_at TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_change_events_node_time
+  ON change_events (project_id, environment, target_node_id, occurred_at DESC);
+
+-- 4. Durable Incident Investigations & Runner Lease Coordination
+CREATE TABLE IF NOT EXISTS incident_investigations (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  dedup_key TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'open',
+  target_node_id TEXT NOT NULL,
+  symptom_anchor_kind TEXT NOT NULL,
+  symptom_anchor_id TEXT NOT NULL,
+  symptom_fingerprint TEXT,
+  alert_count INTEGER NOT NULL DEFAULT 1,
+  latest_bundle_json TEXT,
+  lease_owner_id TEXT,
+  lease_expires_at TEXT,
+  dispatch_attempts INTEGER NOT NULL DEFAULT 0,
+  last_dispatched_at TEXT,
+  opened_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  resolved_at TEXT,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_incidents_active_dedup
+  ON incident_investigations (project_id, environment, dedup_key, status);
+
+-- 5. Closed-Loop Investigation Findings (Separating Recovery vs Causal Proof)
+CREATE TABLE IF NOT EXISTS investigation_findings (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  incident_id TEXT,
+  fingerprint TEXT NOT NULL,
+  fingerprint_input_json TEXT NOT NULL,
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  causal_proof_tier TEXT NOT NULL DEFAULT 'unverified_locus',
+  confidence DOUBLE PRECISION NOT NULL,
+  confidence_breakdown_json TEXT NOT NULL,
+  symptom_entity_kind TEXT NOT NULL,
+  symptom_entity_id TEXT NOT NULL,
+  fault_locus_entity_kind TEXT NOT NULL,
+  fault_locus_entity_id TEXT NOT NULL,
+  root_cause_entity_kind TEXT,
+  root_cause_entity_id TEXT,
+  contributing_change_id TEXT,
+  cohort_verdict TEXT,
+  contending_trace_id TEXT,
+  causal_chain_json TEXT NOT NULL,
+  cited_evidence_ids_json TEXT NOT NULL,
+  code_references_json TEXT,
+  counterfactual_proof_json TEXT,
+  recovery_status TEXT NOT NULL DEFAULT 'not_applicable',
+  causal_verification_status TEXT NOT NULL DEFAULT 'unverified',
+  watchdog_step INTEGER NOT NULL DEFAULT 0,
+  baseline_request_rate_per_min DOUBLE PRECISION,
+  next_watchdog_check_at TEXT,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  agent_run_id TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint
+  ON investigation_findings (project_id, environment, fingerprint, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_findings_watchdog
+  ON investigation_findings (project_id, recovery_status, next_watchdog_check_at);
+
+-- 6. Pre-Execution Remediation Proposals & Single-Use Grants
+CREATE TABLE IF NOT EXISTS remediation_proposals (
+  project_id TEXT NOT NULL DEFAULT 'default',
+  environment TEXT NOT NULL DEFAULT 'default',
+  id TEXT NOT NULL,
+  incident_id TEXT NOT NULL,
+  finding_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  action_kind TEXT NOT NULL,
+  target_node_id TEXT NOT NULL,
+  expected_current_state_json TEXT NOT NULL,
+  desired_target_state_json TEXT NOT NULL,
+  requested_autonomy TEXT NOT NULL,
+  effective_autonomy TEXT NOT NULL,
+  policy_decision_reason TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'proposed',
+  grant_token_hash TEXT,
+  grant_expires_at TEXT,
+  approved_by_user_id TEXT,
+  approved_at TEXT,
+  claimed_by_runner_id TEXT,
+  claimed_at TEXT,
+  claim_expires_at TEXT,
+  remediation_agent_run_id TEXT,
+  resulting_change_id TEXT,
+  failure_reason TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  expires_at TEXT,
+  PRIMARY KEY (project_id, environment, id),
+  UNIQUE (project_id, environment, idempotency_key)
+);

package/src/migrations-postgres/README.md

@@ -32,9 +32,62 @@ remaining migrations are tracked in
 [`docs/postgres-migration.md`](../../../../docs/postgres-migration.md); they'll
 land alongside the first hosted-Postgres deployment.
 
-## What's NOT translated
+## Column types the stores depend on
 
-`009_projects_and_keys.sql` uses SQLite's `BLOB` type for the hashed API key.
-Postgres uses `BYTEA` and the column-name rewrite is in
-`009_projects_and_keys.sql` here (a non-mechanical translation; review carefully
-when porting forward).
+- `ingest_keys.key_hash` is `TEXT` on both backends. `ProjectsStore` binds the
+  SHA-256 hex digest as a string; an earlier Postgres version of `009` declared
+  the column `BYTEA`, which silently stored the ASCII bytes of the hex text and
+  made the `026` seed key unreachable. `041_ingest_key_hash_text.sql` converts
+  databases migrated with that version back to `TEXT` (fresh installs get
+  `TEXT` from `009` directly and `041` is a no-op). The D1 `041` file is an
+  intentional no-op that only keeps the numbering in parity.
+- Timestamp columns (`received_at`, `expires_at`, …) are `TEXT` holding
+  `Date#toISOString()` output. Postgres will not compare `text` to
+  `timestamptz`, so `postgresDialect` and `translateD1Sql` render every time
+  window as ISO text (`to_char(…, 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`).
+  `metric_exemplars` originally declared `received_at`/`expires_at` as
+  `TIMESTAMPTZ`, which made `MetricsStore.purgeExpired` fail with
+  `operator does not exist: timestamp with time zone < text`;
+  `043_metric_exemplars_text_timestamps.sql` converts those columns to UTC
+  ISO `TEXT` in place (fresh installs get `TEXT` from `035` and `043` is a
+  no-op; the D1 `043` is a numbering no-op).
+- `actions.started_at` is ISO `TEXT` and drives action-graph retention (the
+  spine has no `expires_at`). `044_actions_started_at_index.sql` adds
+  `idx_actions_started_at` on both backends so the hourly sweep reads expired
+  trees in index order. Deletes run per tree inside `PostgresAdapter.batch`
+  (one transaction) and re-check eligibility in every statement, but under
+  READ COMMITTED a concurrent insert into an already-expired tree can still
+  land between that tree's leaf deletes and its spine delete; see the header
+  of `src/lib/action-retention.ts`.
+- Row keys are project-scoped. `045`–`048` swap the single-column primary
+  keys for composite ones in place (`user_profiles (project_id, user_id)`;
+  `actions`, `agent_runs`, `tool_calls`, `retrieval_events`, `eval_results`,
+  `artifacts (project_id, id)`; `ai_span_payloads` and
+  `telemetry_spans (project_id, trace_id, span_id)`). Each file looks up the
+  current primary key by definition and is a no-op once the key is
+  composite; the D1 siblings rebuild the tables through `*_new` copies. The
+  stores upsert with `ON CONFLICT (project_id, …)`, so both backends must
+  carry these migrations before deploying collector 2.1.
+- `049` adds `alert_state.notified INTEGER` (0/1, like
+  `alert_evaluations.notified`): whether the current state's transition has
+  been delivered to the rule's channels. Existing rows backfill to 1. The
+  store falls back to the pre-049 statement when the column is missing, so
+  the collector keeps evaluating during a rolling deploy, but it cannot
+  retry undelivered notifications until 049 is applied.
+- Flags (`is_error`, `is_bot`, `payload_capture_enabled`) are `BOOLEAN` here
+  and `INTEGER 0/1` on D1. Shared SQL must test them as bare booleans
+  (`CASE WHEN is_error THEN 1 ELSE 0 END`, never `is_error = 1` or
+  `SUM(is_error)`). Hosts call `configurePostgresTypeParsers(pg.types)` so
+  BOOLEAN reads back as `0/1`, BIGINT/NUMERIC as numbers and JSON/JSONB as
+  text, matching what D1 returns.
+
+## Verifying against a real database
+
+`src/lib/sql-db-postgres.integration.test.ts` applies this directory into an
+empty scratch database, then exercises ingest-key auth, AI/usage ingest, the
+retention purge and every built-in analysis through `PostgresAdapter`:
+
+```bash
+OBS_PG_TEST_URL=postgres://obs:obs@127.0.0.1:5432/obs_scratch \
+  pnpm --filter @obsunified/collector exec vitest run src/lib/sql-db-postgres.integration.test.ts
+```

package/src/otlp/decode/body.test.ts

@@ -0,0 +1,76 @@
+import { gzipSync } from "node:zlib";
+import { Hono } from "hono";
+import { describe, expect, it } from "vitest";
+import { OtlpDecodeError, type ReadBodyLimits, readOtlpBody } from "./body";
+
+const MIB = 1024 * 1024;
+
+const read = async (
+	body: BodyInit,
+	headers: Record<string, string>,
+	limits: ReadBodyLimits = {},
+) => {
+	const app = new Hono().post("/t", async (c) => {
+		try {
+			const result = await readOtlpBody(c, limits);
+			return c.json({
+				bytes: result.bytes.byteLength,
+				wire: result.wireFormat,
+			});
+		} catch (err) {
+			if (err instanceof OtlpDecodeError)
+				return c.json({ error: err.message }, err.status);
+			throw err;
+		}
+	});
+	const res = await app.request("/t", { method: "POST", body, headers });
+	return {
+		status: res.status,
+		body: (await res.json()) as Record<string, unknown>,
+	};
+};
+
+describe("readOtlpBody limits", () => {
+	it("decompresses a normal gzip payload", async () => {
+		const json = JSON.stringify({ resourceSpans: [] });
+		const res = await read(gzipSync(json), {
+			"content-type": "application/json",
+			"content-encoding": "gzip",
+		});
+		expect(res).toEqual({
+			status: 200,
+			body: { bytes: json.length, wire: "json" },
+		});
+	});
+
+	it("refuses a gzip bomb once the decompressed cap is crossed", async () => {
+		// 8 MiB of zeros gzips to a few KiB; the reader must stop at 1 MiB.
+		const bomb = gzipSync(Buffer.alloc(8 * MIB));
+		expect(bomb.byteLength).toBeLessThan(64 * 1024);
+		const res = await read(
+			bomb,
+			{ "content-type": "application/x-protobuf", "content-encoding": "gzip" },
+			{ maxDecompressedBytes: MIB },
+		);
+		expect(res.status).toBe(413);
+		expect(res.body.error).toMatch(/Decompressed payload too large/);
+	});
+
+	it("refuses a raw body over the configured cap", async () => {
+		const res = await read(
+			"x".repeat(2048),
+			{ "content-type": "application/json" },
+			{ maxBodyBytes: 1024 },
+		);
+		expect(res.status).toBe(413);
+		expect(res.body.error).toMatch(/Payload too large \(max 1024 bytes\)/);
+	});
+
+	it("reports malformed gzip as 400, not 500", async () => {
+		const res = await read("definitely not gzip", {
+			"content-type": "application/json",
+			"content-encoding": "gzip",
+		});
+		expect(res.status).toBe(400);
+	});
+});