@opengeni/db 0.10.7 → 0.12.1

package/drizzle/0118_new_session_drafts.sql

@@ -0,0 +1,59 @@
+-- deployment-mode: rolling
+-- Actor-private, server-authoritative composer state before a session exists.
+-- This is intentionally separate from composer_drafts, whose non-null session
+-- foreign key is a load-bearing invariant for established-session queue edits.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE TABLE "new_session_drafts" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "subject_id" text NOT NULL,
+  "revision" bigint DEFAULT 1 NOT NULL,
+  "text" text DEFAULT '' NOT NULL,
+  "resources" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "tools" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "model" text NOT NULL,
+  "reasoning_effort" text NOT NULL,
+  "session_options" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamptz DEFAULT now() NOT NULL,
+  "updated_at" timestamptz DEFAULT now() NOT NULL,
+  CONSTRAINT "new_session_drafts_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces" ("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "new_session_drafts_subject_check"
+    CHECK (length(btrim("subject_id")) > 0),
+  CONSTRAINT "new_session_drafts_revision_check" CHECK ("revision" >= 1)
+);
+
+CREATE UNIQUE INDEX "new_session_drafts_subject_workspace_uq"
+  ON "new_session_drafts" ("workspace_id", "subject_id");
+
+ALTER TABLE "new_session_drafts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "new_session_drafts" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON "new_session_drafts"
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  );
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.new_session_drafts TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END $grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0119_pending_tool_output_policy.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- Preserve the resolved exact-model tool-output policy with raw pending receipts
+-- so any later recovery stores the same canonical model-facing bytes.
+ALTER TABLE "session_pending_tool_calls"
+  ADD COLUMN "model_tool_output_truncation_tokens" integer;

package/drizzle/0120_durable_goal_wake.sql

@@ -0,0 +1,360 @@
+-- deployment-mode: rolling
+-- OPE-59: a goal-owned, monotonic continuation obligation. PostgreSQL is the
+-- authority; Temporal receives only repairable workflow nudges.
+--
+-- Migrations run as the table owner, but FORCE ROW LEVEL SECURITY still makes
+-- that owner subject to workspace policies. This cross-workspace repair has no
+-- tenant GUC and must therefore relax only the owner-visible posture for the
+-- duration of this file. The migration runner executes the file in one
+-- implicit transaction, so a failure rolls back both the data repair and the
+-- posture changes; the final FORCE statements restore the shipped posture on
+-- success. The application role remains non-bypass and policy-bound.
+ALTER TABLE "session_goals" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_system_updates" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_workflow_wake_outbox" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "sessions" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "workspace_inference_controls" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_turns" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "codex_capacity_waiters" NO FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE "session_goals"
+  ADD COLUMN IF NOT EXISTS "continuation_wake_revision" bigint NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS "continuation_observed_revision" bigint NOT NULL DEFAULT 0;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'session_goals_continuation_revision_check'
+      AND conrelid = 'session_goals'::regclass
+  ) THEN
+    ALTER TABLE "session_goals"
+      ADD CONSTRAINT "session_goals_continuation_revision_check"
+      CHECK (
+        "continuation_wake_revision" >= 0
+        AND "continuation_observed_revision" >= 0
+        AND "continuation_observed_revision" <= "continuation_wake_revision"
+        AND "continuation_wake_revision" <= 9007199254740991
+        AND "continuation_observed_revision" <= 9007199254740991
+      );
+  END IF;
+END $$;
+
+-- Drizzle and every public workflow/client contract represent revisions as
+-- JavaScript numbers. Reject manual corruption or impossible exhaustion in
+-- PostgreSQL before a bigint can be rounded into another producer's revision.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'session_workflow_wake_outbox_revision_safe_check'
+      AND conrelid = 'session_workflow_wake_outbox'::regclass
+  ) THEN
+    ALTER TABLE "session_workflow_wake_outbox"
+      ADD CONSTRAINT "session_workflow_wake_outbox_revision_safe_check"
+      CHECK (
+        "wake_revision" <= 9007199254740991
+        AND "delivered_revision" <= 9007199254740991
+      );
+  END IF;
+END $$;
+
+-- Legacy evaluation and update insertion were separate commits. A lost
+-- response could therefore leave more than one current-version continuation,
+-- and old generic failure handling could leave the only one deferred (which
+-- is intentionally not independently runnable). Preserve the earliest
+-- admitted update, normalize it to pending, and cancel later duplicates before
+-- assigning the baseline obligation.
+WITH ranked AS (
+  SELECT update.id,
+         row_number() OVER (
+           PARTITION BY update.workspace_id, update.session_id
+           ORDER BY update.created_at, update.id
+         ) AS ordinal
+  FROM "session_system_updates" AS update
+  JOIN "session_goals" AS goal
+    ON goal.workspace_id = update.workspace_id
+   AND goal.session_id = update.session_id
+   AND update.payload ->> 'goalId' = goal.id::text
+   AND jsonb_typeof(update.payload -> 'goalVersion') = 'number'
+   AND update.payload ->> 'goalVersion' ~ '^[1-9][0-9]*$'
+   AND update.payload ->> 'goalVersion' = goal.version::text
+  WHERE goal.status = 'active'
+    AND update.kind = 'goal_continuation'
+    AND update.state IN ('pending', 'deferred')
+)
+UPDATE "session_system_updates" AS update
+SET state = CASE WHEN ranked.ordinal = 1 THEN 'pending' ELSE 'cancelled' END,
+    delivered_turn_id = NULL,
+    delivered_at = NULL
+FROM ranked
+WHERE update.id = ranked.id;
+
+-- A surviving current-version pending continuation is already-materialized
+-- work. Mark one synthetic baseline revision observed so deployment cannot
+-- manufacture another continuation beside it. This baseline is valid even
+-- while admission is paused: Resume will rediscover the pending update and
+-- register its own authoritative wake. Only effectively-active targets receive
+-- a rollout wake here. The fresh wake is required even when an older signal
+-- revision was acknowledged: its workflow may have died after signal delivery
+-- but before claiming the update. A delivered update is not itself
+-- outstanding: its owning nonterminal turn is protected by the repair query
+-- below, while an idle goal whose delivered turn already settled still needs a
+-- new obligation. Likewise, a stale-version update cannot satisfy the current
+-- goal.
+--
+-- Keep this admission projection identical to projectEffectiveControl:
+-- descendant overrides defeat only more-distant session pauses, any ancestry
+-- override may defeat a workspace pause, and incomplete/cyclic/over-limit
+-- ancestry fails closed. The recursive term admits a root at depth 10,000 but
+-- stops before traversing past it, matching SESSION_ANCESTRY_LIMIT.
+WITH RECURSIVE materialized AS (
+  SELECT goal.id, goal.account_id, goal.workspace_id, goal.session_id,
+         COALESCE(session.temporal_workflow_id, 'session-' || session.id::text) AS workflow_id
+  FROM "session_goals" AS goal
+  JOIN "sessions" AS session
+    ON session.workspace_id = goal.workspace_id AND session.id = goal.session_id
+  WHERE goal.status = 'active'
+    AND goal.continuation_wake_revision = 0
+    AND goal.continuation_observed_revision = 0
+    AND EXISTS (
+      SELECT 1
+      FROM "session_system_updates" AS update
+      WHERE update.workspace_id = goal.workspace_id
+        AND update.session_id = goal.session_id
+        AND update.kind = 'goal_continuation'
+        AND update.state = 'pending'
+        AND update.payload ->> 'goalId' = goal.id::text
+        AND jsonb_typeof(update.payload -> 'goalVersion') = 'number'
+        AND update.payload ->> 'goalVersion' ~ '^[1-9][0-9]*$'
+        AND update.payload ->> 'goalVersion' = goal.version::text
+    )
+), ancestry AS (
+  SELECT materialized.id AS goal_id, session.workspace_id,
+         session.id AS session_id, session.parent_session_id,
+         session.direct_control_state, session.direct_pause_revision,
+         session.subtree_run_override_revision,
+         0::integer AS depth, ARRAY[session.id]::uuid[] AS path, false AS cycle
+  FROM materialized
+  JOIN "sessions" AS session
+    ON session.workspace_id = materialized.workspace_id
+   AND session.id = materialized.session_id
+  UNION ALL
+  SELECT child.goal_id, parent.workspace_id,
+         parent.id, parent.parent_session_id,
+         parent.direct_control_state, parent.direct_pause_revision,
+         parent.subtree_run_override_revision,
+         child.depth + 1, child.path || parent.id,
+         parent.id = ANY(child.path)
+  FROM ancestry AS child
+  JOIN "sessions" AS parent
+    ON parent.workspace_id = child.workspace_id
+   AND parent.id = child.parent_session_id
+  WHERE child.parent_session_id IS NOT NULL
+    AND NOT child.cycle
+    AND child.depth < 10000
+), admitted AS (
+  SELECT materialized.id
+  FROM materialized
+  JOIN "workspace_inference_controls" AS control
+    ON control.workspace_id = materialized.workspace_id
+  WHERE EXISTS (
+      SELECT 1
+      FROM ancestry AS root
+      WHERE root.goal_id = materialized.id
+        AND root.parent_session_id IS NULL
+        AND NOT root.cycle
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM ancestry AS invalid
+      WHERE invalid.goal_id = materialized.id AND invalid.cycle
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM ancestry AS pause
+      WHERE pause.goal_id = materialized.id
+        AND pause.direct_control_state = 'paused'
+        AND NOT EXISTS (
+          SELECT 1
+          FROM ancestry AS override
+          WHERE override.goal_id = materialized.id
+            AND override.depth < pause.depth
+            AND override.subtree_run_override_revision > pause.direct_pause_revision
+        )
+    )
+    AND (
+      control.workspace_state = 'active'
+      OR (
+        control.workspace_state = 'paused'
+        AND EXISTS (
+          SELECT 1
+          FROM ancestry AS override
+          WHERE override.goal_id = materialized.id
+            AND override.subtree_run_override_revision > control.workspace_pause_revision
+        )
+      )
+    )
+), baselined AS (
+  UPDATE "session_goals" AS goal
+  SET "continuation_wake_revision" = 1,
+      "continuation_observed_revision" = 1,
+      "updated_at" = now()
+  FROM materialized
+  WHERE goal.id = materialized.id
+  RETURNING materialized.account_id, materialized.workspace_id,
+            materialized.session_id, materialized.workflow_id,
+            EXISTS (SELECT 1 FROM admitted WHERE admitted.id = materialized.id) AS admitted
+)
+INSERT INTO "session_workflow_wake_outbox" (
+  "session_id", "account_id", "workspace_id", "temporal_workflow_id",
+  "wake_revision", "delivered_revision", "reason", "attempts",
+  "next_attempt_at", "created_at", "updated_at"
+)
+SELECT session_id, account_id, workspace_id, workflow_id,
+       1, 0, 'goal_materialized_backfill', 0, now(), now(), now()
+FROM baselined
+WHERE admitted
+ON CONFLICT ("session_id") DO UPDATE SET
+  "temporal_workflow_id" = EXCLUDED."temporal_workflow_id",
+  "wake_revision" = "session_workflow_wake_outbox"."wake_revision" + 1,
+  "reason" = EXCLUDED."reason",
+  "attempts" = 0,
+  "next_attempt_at" = LEAST("session_workflow_wake_outbox"."next_attempt_at", EXCLUDED."next_attempt_at"),
+  "last_error" = NULL,
+  "updated_at" = now();
+
+-- An active, admitted-idle goal with neither work nor a capacity waiter is the
+-- legacy catch-and-idle hole. Arm exactly one revision. Human/API queue rows,
+-- live/approval turns, capacity waiters, and paused or malformed ancestry
+-- remain authoritative and will arm or resume through their own boundary.
+WITH RECURSIVE candidates AS (
+  SELECT goal.id, goal.account_id, goal.workspace_id, goal.session_id,
+         COALESCE(session.temporal_workflow_id, 'session-' || session.id::text) AS workflow_id
+  FROM "session_goals" AS goal
+  JOIN "sessions" AS session
+    ON session.workspace_id = goal.workspace_id AND session.id = goal.session_id
+  WHERE goal.status = 'active'
+    -- Only untouched legacy rows are deployment repair candidates. The
+    -- baseline update above deliberately changes already-materialized goals to
+    -- 1/1; accepting arbitrary equal revisions here would immediately re-arm
+    -- those same goals and manufacture a duplicate continuation.
+    AND goal.continuation_wake_revision = 0
+    AND goal.continuation_observed_revision = 0
+    AND session.status <> 'cancelled'
+    AND session.active_turn_id IS NULL
+    AND NOT EXISTS (
+      SELECT 1
+      FROM "session_turns" AS turn
+      WHERE turn.workspace_id = goal.workspace_id
+        AND turn.session_id = goal.session_id
+        AND turn.status IN ('queued', 'running', 'requires_action', 'recovering', 'waiting_capacity')
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM "codex_capacity_waiters" AS waiter
+      WHERE waiter.workspace_id = goal.workspace_id
+        AND waiter.session_id = goal.session_id
+        AND waiter.status = 'waiting'
+    )
+), ancestry AS (
+  SELECT candidate.id AS goal_id, session.workspace_id,
+         session.id AS session_id, session.parent_session_id,
+         session.direct_control_state, session.direct_pause_revision,
+         session.subtree_run_override_revision,
+         0::integer AS depth, ARRAY[session.id]::uuid[] AS path, false AS cycle
+  FROM candidates AS candidate
+  JOIN "sessions" AS session
+    ON session.workspace_id = candidate.workspace_id
+   AND session.id = candidate.session_id
+  UNION ALL
+  SELECT child.goal_id, parent.workspace_id,
+         parent.id, parent.parent_session_id,
+         parent.direct_control_state, parent.direct_pause_revision,
+         parent.subtree_run_override_revision,
+         child.depth + 1, child.path || parent.id,
+         parent.id = ANY(child.path)
+  FROM ancestry AS child
+  JOIN "sessions" AS parent
+    ON parent.workspace_id = child.workspace_id
+   AND parent.id = child.parent_session_id
+  WHERE child.parent_session_id IS NOT NULL
+    AND NOT child.cycle
+    AND child.depth < 10000
+), repairable AS (
+  SELECT candidate.*
+  FROM candidates AS candidate
+  JOIN "workspace_inference_controls" AS control
+    ON control.workspace_id = candidate.workspace_id
+  WHERE EXISTS (
+      SELECT 1
+      FROM ancestry AS root
+      WHERE root.goal_id = candidate.id
+        AND root.parent_session_id IS NULL
+        AND NOT root.cycle
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM ancestry AS invalid
+      WHERE invalid.goal_id = candidate.id AND invalid.cycle
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM ancestry AS pause
+      WHERE pause.goal_id = candidate.id
+        AND pause.direct_control_state = 'paused'
+        AND NOT EXISTS (
+          SELECT 1
+          FROM ancestry AS override
+          WHERE override.goal_id = candidate.id
+            AND override.depth < pause.depth
+            AND override.subtree_run_override_revision > pause.direct_pause_revision
+        )
+    )
+    AND (
+      control.workspace_state = 'active'
+      OR (
+        control.workspace_state = 'paused'
+        AND EXISTS (
+          SELECT 1
+          FROM ancestry AS override
+          WHERE override.goal_id = candidate.id
+            AND override.subtree_run_override_revision > control.workspace_pause_revision
+        )
+      )
+    )
+), armed AS (
+  UPDATE "session_goals" AS goal
+  SET "continuation_wake_revision" = goal.continuation_wake_revision + 1,
+      "updated_at" = now()
+  FROM repairable
+  WHERE goal.id = repairable.id
+  RETURNING repairable.account_id, repairable.workspace_id,
+            repairable.session_id, repairable.workflow_id
+)
+INSERT INTO "session_workflow_wake_outbox" (
+  "session_id", "account_id", "workspace_id", "temporal_workflow_id",
+  "wake_revision", "delivered_revision", "reason", "attempts",
+  "next_attempt_at", "created_at", "updated_at"
+)
+SELECT session_id, account_id, workspace_id, workflow_id,
+       1, 0, 'goal_obligation_backfill', 0, now(), now(), now()
+FROM armed
+ON CONFLICT ("session_id") DO UPDATE SET
+  "temporal_workflow_id" = EXCLUDED."temporal_workflow_id",
+  "wake_revision" = "session_workflow_wake_outbox"."wake_revision" + 1,
+  "reason" = EXCLUDED."reason",
+  "attempts" = 0,
+  "next_attempt_at" = LEAST("session_workflow_wake_outbox"."next_attempt_at", EXCLUDED."next_attempt_at"),
+  "last_error" = NULL,
+  "updated_at" = now();
+
+ALTER TABLE "session_goals" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_system_updates" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_workflow_wake_outbox" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "sessions" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "workspace_inference_controls" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "session_turns" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "codex_capacity_waiters" FORCE ROW LEVEL SECURITY;

package/drizzle/0121_goal_update_idempotency.sql

@@ -0,0 +1,11 @@
+-- deployment-mode: rolling
+
+-- A goal_update operation belongs to the target goal/session, not to one
+-- replaceable worker attempt. The receipt retains its original attempt FK for
+-- audit, while this partial identity lets a recovered attempt reconcile the
+-- exact committed result.
+CREATE UNIQUE INDEX "session_command_receipts_goal_update_operation_uq"
+  ON "session_command_receipts" (
+    "workspace_id", "action", "target_session_id", "operation_key"
+  )
+  WHERE "action" = 'goal.update';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.10.7",
+  "version": "0.12.1",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -50,8 +50,8 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.6.9",
-    "@opengeni/contracts": "^0.18.0",
+    "@opengeni/config": "^0.7.1",
+    "@opengeni/contracts": "^0.19.0",
     "@opengeni/network": "^0.1.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"