@opengeni/db 0.12.1 → 0.12.6

package/drizzle/0126_document_access_constraints.sql

@@ -0,0 +1,138 @@
+-- deployment-mode: rolling
+-- Document access and knowledge-drop state hardening.
+--
+-- Existing raced Default rows are consolidated before the unique index is
+-- installed by the following concurrent migration. This migration also
+-- repairs legacy document state before adding validated checks, so an upgrade
+-- cannot strand an otherwise readable database behind an invalid old value.
+
+DO $$
+DECLARE
+  duplicate RECORD;
+BEGIN
+  FOR duplicate IN
+    SELECT workspace_id, min(id::text)::uuid AS keep_id
+    FROM document_bases
+    WHERE lower(btrim(name)) = 'default'
+    GROUP BY workspace_id
+    HAVING count(*) > 1
+  LOOP
+    -- A file can only occur once in a base. Keep the lexicographically first
+    -- Default row's document when an old race created the same file twice.
+    DELETE FROM documents duplicate_document
+    WHERE duplicate_document.workspace_id = duplicate.workspace_id
+      AND duplicate_document.base_id <> duplicate.keep_id
+      AND lower(btrim((SELECT name FROM document_bases WHERE id = duplicate_document.base_id))) = 'default'
+      AND EXISTS (
+        SELECT 1
+        FROM documents retained_document
+        WHERE retained_document.workspace_id = duplicate.workspace_id
+          AND retained_document.base_id = duplicate.keep_id
+          AND retained_document.file_id = duplicate_document.file_id
+      );
+
+    UPDATE documents
+    SET base_id = duplicate.keep_id,
+        updated_at = now()
+    WHERE workspace_id = duplicate.workspace_id
+      AND base_id <> duplicate.keep_id
+      AND lower(btrim((SELECT name FROM document_bases WHERE id = base_id))) = 'default';
+
+    UPDATE document_chunks chunk
+    SET base_id = duplicate.keep_id
+    WHERE chunk.workspace_id = duplicate.workspace_id
+      AND chunk.base_id <> duplicate.keep_id
+      AND EXISTS (
+        SELECT 1
+        FROM documents document
+        WHERE document.id = chunk.document_id
+          AND document.base_id = duplicate.keep_id
+      );
+
+    DELETE FROM document_bases base
+    WHERE base.workspace_id = duplicate.workspace_id
+      AND base.id <> duplicate.keep_id
+      AND lower(btrim(base.name)) = 'default';
+  END LOOP;
+END
+$$;
+
+-- Rows written before these fields were governed may contain values outside
+-- the new state machine. Preserve the document and its retrieval posture while
+-- normalizing only states that have no safe interpretation.
+UPDATE "documents"
+SET "visibility" = 'workspace'
+WHERE "visibility" IS NULL OR "visibility" NOT IN ('workspace', 'private');
+
+UPDATE "documents"
+SET "visibility" = 'workspace', "created_by" = NULL
+WHERE "visibility" = 'private' AND NULLIF(btrim("created_by"), '') IS NULL;
+
+UPDATE "documents"
+SET "curation_status" = 'none'
+WHERE "curation_status" IS NULL
+   OR "curation_status" NOT IN ('none', 'pending', 'suggested', 'auto_filed', 'failed');
+
+UPDATE "documents"
+SET "topics" = '[]'::jsonb
+WHERE "topics" IS NULL OR jsonb_typeof("topics") <> 'array';
+
+UPDATE "documents"
+SET "curation" = NULL
+WHERE "curation" IS NOT NULL AND jsonb_typeof("curation") <> 'object';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'documents_visibility_chk'
+      AND conrelid = 'documents'::regclass
+  ) THEN
+    ALTER TABLE "documents"
+      ADD CONSTRAINT "documents_visibility_chk"
+      CHECK ("visibility" IN ('workspace', 'private')) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'documents_curation_status_chk'
+      AND conrelid = 'documents'::regclass
+  ) THEN
+    ALTER TABLE "documents"
+      ADD CONSTRAINT "documents_curation_status_chk"
+      CHECK ("curation_status" IN ('none', 'pending', 'suggested', 'auto_filed', 'failed')) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'documents_private_creator_chk'
+      AND conrelid = 'documents'::regclass
+  ) THEN
+    ALTER TABLE "documents"
+      ADD CONSTRAINT "documents_private_creator_chk"
+      CHECK ("visibility" <> 'private' OR NULLIF(btrim("created_by"), '') IS NOT NULL) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'documents_topics_array_chk'
+      AND conrelid = 'documents'::regclass
+  ) THEN
+    ALTER TABLE "documents"
+      ADD CONSTRAINT "documents_topics_array_chk"
+      CHECK (jsonb_typeof("topics") = 'array') NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'documents_curation_object_chk'
+      AND conrelid = 'documents'::regclass
+  ) THEN
+    ALTER TABLE "documents"
+      ADD CONSTRAINT "documents_curation_object_chk"
+      CHECK ("curation" IS NULL OR jsonb_typeof("curation") = 'object') NOT VALID;
+  END IF;
+END
+$$;
+
+ALTER TABLE "documents" VALIDATE CONSTRAINT "documents_visibility_chk";
+ALTER TABLE "documents" VALIDATE CONSTRAINT "documents_curation_status_chk";
+ALTER TABLE "documents" VALIDATE CONSTRAINT "documents_private_creator_chk";
+ALTER TABLE "documents" VALIDATE CONSTRAINT "documents_topics_array_chk";
+ALTER TABLE "documents" VALIDATE CONSTRAINT "documents_curation_object_chk";

package/drizzle/0127_document_default_base_index.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "document_bases_workspace_default_name_uq"
+  ON "document_bases" ("workspace_id")
+  WHERE lower(btrim("name")) = 'default';

package/drizzle/0128_github_installation_authority.sql

@@ -0,0 +1,69 @@
+-- deployment-mode: rolling
+
+ALTER TABLE "github_installations"
+  ADD COLUMN IF NOT EXISTS "github_account_id" bigint,
+  ADD COLUMN IF NOT EXISTS "github_actor_id" bigint,
+  ADD COLUMN IF NOT EXISTS "github_actor_login" text,
+  ADD COLUMN IF NOT EXISTS "authority_kind" text,
+  ADD COLUMN IF NOT EXISTS "authority_checked_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "authority_expires_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "authority_nonce" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installations_authority_kind_check'
+      AND conrelid = 'github_installations'::regclass
+  ) THEN
+    ALTER TABLE "github_installations"
+      ADD CONSTRAINT "github_installations_authority_kind_check"
+      CHECK (
+        (
+          "github_account_id" IS NULL
+          AND "github_actor_id" IS NULL
+          AND "github_actor_login" IS NULL
+          AND "authority_kind" IS NULL
+          AND "authority_checked_at" IS NULL
+          AND "authority_expires_at" IS NULL
+          AND "authority_nonce" IS NULL
+        )
+        OR (
+          "github_account_id" IS NOT NULL
+          AND "github_account_id" > 0
+          AND "github_actor_id" IS NOT NULL
+          AND "github_actor_id" > 0
+          AND "github_actor_login" IS NOT NULL
+          AND length("github_actor_login") > 0
+          AND "account_login" IS NOT NULL
+          AND length("account_login") > 0
+          AND "account_type" IS NOT NULL
+          AND "linked_by_subject_id" IS NOT NULL
+          AND length("linked_by_subject_id") > 0
+          AND "authority_kind" IS NOT NULL
+          AND "authority_checked_at" IS NOT NULL
+          AND "authority_expires_at" IS NOT NULL
+          AND "authority_checked_at" < "authority_expires_at"
+          AND "authority_expires_at" <= "authority_checked_at" + interval '10 minutes'
+          AND "authority_nonce" IS NOT NULL
+          AND length("authority_nonce") > 0
+          AND "repository_scope" = 'selected'
+          AND (
+            (
+              "authority_kind" = 'personal_owner'
+              AND "account_type" = 'User'
+              AND "github_actor_id" = "github_account_id"
+            )
+            OR (
+              "authority_kind" = 'organization_owner'
+              AND "account_type" = 'Organization'
+            )
+          )
+        )
+      );
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "github_installations_authority_nonce_uq"
+  ON "github_installations" ("authority_nonce")
+  WHERE "authority_nonce" IS NOT NULL;

package/drizzle/0129_retained_process_reconciliation.sql

@@ -0,0 +1,356 @@
+-- deployment-mode: rolling
+-- Terminal owners do not prove provider quiescence. Persist only a
+-- bounded/fair reconciliation claim here; the worker must still obtain an exact
+-- provider exit/loss proof before invoking canonical retained-process settlement.
+
+ALTER TABLE "sandbox_retained_processes"
+  ADD COLUMN IF NOT EXISTS "reconcile_after" timestamptz NOT NULL DEFAULT now(),
+  ADD COLUMN IF NOT EXISTS "reconcile_claim_id" uuid,
+  ADD COLUMN IF NOT EXISTS "reconcile_claimed_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "reconcile_attempts" integer NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS "last_reconcile_outcome" text,
+  ADD COLUMN IF NOT EXISTS "reconcile_proof_outcome" text,
+  ADD COLUMN IF NOT EXISTS "reconcile_proof_exit_code" integer,
+  ADD COLUMN IF NOT EXISTS "reconcile_proof_reason" text,
+  ADD COLUMN IF NOT EXISTS "reconcile_proof_observed_at" timestamptz;
+
+ALTER TABLE "sandbox_retained_processes"
+  ADD CONSTRAINT "sandbox_retained_processes_reconcile_claim_check"
+  CHECK (
+    ("reconcile_claim_id" IS NULL AND "reconcile_claimed_at" IS NULL)
+    OR ("reconcile_claim_id" IS NOT NULL AND "reconcile_claimed_at" IS NOT NULL)
+  ),
+  ADD CONSTRAINT "sandbox_retained_processes_reconcile_attempts_check"
+  CHECK ("reconcile_attempts" >= 0),
+  ADD CONSTRAINT "sandbox_retained_processes_reconcile_outcome_check"
+  CHECK (
+    "last_reconcile_outcome" IS NULL
+    OR octet_length("last_reconcile_outcome") BETWEEN 1 AND 64
+  ),
+  ADD CONSTRAINT "sandbox_retained_processes_reconcile_proof_check"
+  CHECK (
+    (
+      "reconcile_proof_outcome" IS NULL
+      AND "reconcile_proof_exit_code" IS NULL
+      AND "reconcile_proof_reason" IS NULL
+      AND "reconcile_proof_observed_at" IS NULL
+    ) OR (
+      "reconcile_proof_outcome" = 'exited'
+      AND "reconcile_proof_exit_code" IS NOT NULL
+      AND "reconcile_proof_reason" = 'provider_exit_banner'
+      AND "reconcile_proof_observed_at" IS NOT NULL
+    ) OR (
+      "reconcile_proof_outcome" = 'lost'
+      AND "reconcile_proof_exit_code" IS NULL
+      AND "reconcile_proof_reason" IN (
+        'provider_session_lost_banner', 'provider_instance_not_found'
+      )
+      AND "reconcile_proof_observed_at" IS NOT NULL
+    )
+  );
+
+CREATE INDEX "sandbox_retained_processes_reconcile_due_idx"
+  ON "sandbox_retained_processes" ("reconcile_after", "started_at", "id")
+  WHERE "state" = 'active';
+
+CREATE INDEX "sandbox_retained_processes_active_inventory_idx"
+  ON "sandbox_retained_processes" (
+    "owner_actor_kind", "workspace_id", "owner_turn_id", "owner_attempt_id"
+  )
+  WHERE "state" = 'active';
+
+CREATE INDEX "sandbox_leases_expired_draining_inventory_idx"
+  ON "sandbox_leases" ("expires_at", "backend")
+  WHERE "liveness" = 'draining';
+
+-- The data schema is selected by the migration caller and may be public or a
+-- dedicated embed schema. Bind it into every privileged statement at creation
+-- time, then expose only pg_catalog at execution time. pg_temp and the caller's
+-- search_path can therefore resolve neither relations nor helper functions.
+DO $privileged_functions$
+DECLARE data_schema text := current_schema();
+BEGIN
+  -- The claim update fires this pre-existing deferred trigger while the claim
+  -- function's pg_catalog-only path is active. Replace its 0117 body in place so
+  -- the transitive identity check is equally independent of caller/pg_temp path.
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.validate_sandbox_retained_process_v2()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1
+        FROM %1$I.sandbox_workspace_mutation_admissions admission
+        WHERE admission.id = NEW.parent_admission_id
+          AND admission.account_id = NEW.account_id
+          AND admission.workspace_id = NEW.workspace_id
+          AND admission.session_id = NEW.session_id
+          AND admission.lease_id = NEW.lease_id
+          AND admission.sandbox_group_id = NEW.sandbox_group_id
+          AND admission.actor_kind = NEW.owner_actor_kind
+          AND admission.actor_id = NEW.owner_actor_id
+          AND admission.turn_id IS NOT DISTINCT FROM NEW.owner_turn_id
+          AND admission.attempt_id IS NOT DISTINCT FROM NEW.owner_attempt_id
+          AND admission.execution_generation IS NOT DISTINCT FROM NEW.owner_execution_generation
+          AND admission.lease_epoch = NEW.lease_epoch
+          AND admission.provider_backend = NEW.provider_backend
+          AND admission.provider_instance_id = NEW.provider_instance_id
+          AND admission.route_kind = NEW.route_kind
+          AND admission.route_target_id IS NOT DISTINCT FROM NEW.route_target_id
+          AND admission.route_epoch = NEW.route_epoch
+          AND (
+            (
+              NEW.state = 'active'
+              AND admission.provider_outcome = 'retained'
+              AND admission.settled_at IS NULL
+              AND EXISTS (
+                SELECT 1 FROM %1$I.sandbox_lease_holders holder
+                WHERE holder.lease_id = NEW.lease_id
+                  AND holder.account_id = NEW.account_id
+                  AND holder.workspace_id = NEW.workspace_id
+                  AND holder.kind = 'process'
+                  AND holder.holder_id = NEW.holder_id
+                  AND holder.subject_id = NEW.session_id
+              )
+            ) OR (
+              NEW.state IN ('exited', 'lost')
+              AND admission.provider_outcome IN ('resolved', 'rejected')
+              AND admission.settled_at IS NOT NULL
+              AND NOT EXISTS (
+                SELECT 1 FROM %1$I.sandbox_lease_holders holder
+                WHERE holder.lease_id = NEW.lease_id
+                  AND holder.kind = 'process'
+                  AND holder.holder_id = NEW.holder_id
+              )
+              AND NOT EXISTS (
+                SELECT 1 FROM %1$I.sandbox_pty_sessions pty
+                WHERE pty.retained_process_id = NEW.id
+                  AND pty.status = 'open'
+              )
+            )
+          )
+      ) THEN
+        RAISE EXCEPTION 'retained process does not match its parent admission and holder state'
+          USING ERRCODE = '55000';
+      END IF;
+      RETURN NEW;
+    END;
+    $function$;
+  $create$, data_schema);
+
+  -- Cross-workspace claim for the sole control-worker reaper. The index-backed
+  -- candidate window is locked and limited before owner eligibility joins. A
+  -- live owner is deferred so it cannot permanently occupy the oldest due edge.
+  -- Claim expiry is represented by reconcile_after; it remains coordination
+  -- recovery only and is never physical-exit proof.
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_terminal_retained_processes(
+      p_claim_id uuid,
+      p_limit integer,
+      p_claim_ttl_ms bigint
+    )
+    RETURNS TABLE (
+      account_id uuid,
+      workspace_id uuid,
+      session_id uuid,
+      process_id uuid,
+      claim_id uuid,
+      owner_state text,
+      owner_attempt_outcome text
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_limit < 1 OR p_limit > 100 THEN
+        RAISE EXCEPTION 'retained-process reconciliation limit must be between 1 and 100'
+          USING ERRCODE = '22023';
+      END IF;
+      IF p_claim_ttl_ms < 0 OR p_claim_ttl_ms > 3600000 THEN
+        RAISE EXCEPTION 'retained-process reconciliation claim TTL is invalid'
+          USING ERRCODE = '22023';
+      END IF;
+
+      PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+
+      RETURN QUERY
+      WITH candidate_window AS MATERIALIZED (
+        SELECT process.id,
+          process.workspace_id,
+          process.owner_actor_kind,
+          process.owner_turn_id,
+          process.owner_attempt_id,
+          process.reconcile_after AS due_at,
+          process.started_at
+        FROM %1$I.sandbox_retained_processes process
+        WHERE process.state = 'active'
+          AND process.reconcile_after <= pg_catalog.now()
+        ORDER BY process.reconcile_after, process.started_at, process.id
+        FOR UPDATE OF process SKIP LOCKED
+        LIMIT p_limit
+      ), classified AS MATERIALIZED (
+        SELECT candidate.id,
+          candidate.due_at,
+          candidate.started_at,
+          candidate.owner_actor_kind = 'direct' OR attempt.state = 'closed' AS eligible,
+          CASE
+            WHEN candidate.owner_actor_kind = 'direct' THEN 'direct'
+            ELSE COALESCE(turn_row.status, 'missing')
+          END AS owner_state,
+          attempt.outcome AS owner_attempt_outcome
+        FROM candidate_window candidate
+        LEFT JOIN LATERAL (
+          SELECT source_turn.status
+          FROM %1$I.session_turns source_turn
+          WHERE source_turn.workspace_id = candidate.workspace_id
+            AND source_turn.id = candidate.owner_turn_id
+          LIMIT 1
+        ) turn_row ON true
+        LEFT JOIN LATERAL (
+          SELECT source_attempt.state, source_attempt.outcome
+          FROM %1$I.session_turn_attempts source_attempt
+          WHERE source_attempt.workspace_id = candidate.workspace_id
+            AND source_attempt.id = candidate.owner_attempt_id
+          LIMIT 1
+        ) attempt ON true
+      ), inspected AS (
+        UPDATE %1$I.sandbox_retained_processes process SET
+          reconcile_after = CASE
+            WHEN classified.eligible THEN pg_catalog.now()
+              + pg_catalog.make_interval(secs => p_claim_ttl_ms / 1000.0)
+            ELSE pg_catalog.now() + interval '30 seconds'
+          END,
+          reconcile_claim_id = CASE WHEN classified.eligible THEN p_claim_id ELSE NULL END,
+          reconcile_claimed_at = CASE
+            WHEN classified.eligible THEN pg_catalog.now() ELSE NULL
+          END,
+          reconcile_attempts = process.reconcile_attempts
+            + CASE WHEN classified.eligible THEN 1 ELSE 0 END,
+          last_reconcile_outcome = CASE
+            WHEN classified.eligible THEN 'claimed' ELSE 'owner_active'
+          END
+        FROM classified
+        WHERE process.id = classified.id
+          AND process.state = 'active'
+        RETURNING process.account_id,
+          process.workspace_id,
+          process.session_id,
+          process.id,
+          process.reconcile_claim_id,
+          classified.due_at,
+          classified.started_at,
+          classified.eligible,
+          classified.owner_state,
+          classified.owner_attempt_outcome
+      )
+      SELECT inspected.account_id,
+        inspected.workspace_id,
+        inspected.session_id,
+        inspected.id,
+        inspected.reconcile_claim_id,
+        inspected.owner_state,
+        inspected.owner_attempt_outcome
+      FROM inspected
+      WHERE inspected.eligible
+      ORDER BY inspected.due_at, inspected.started_at, inspected.id;
+
+      -- Fire the exact data-schema constraint trigger while the definer still
+      -- owns cross-workspace visibility, then restore deferred mode.
+      SET CONSTRAINTS %1$I.sandbox_retained_processes_identity_v2 IMMEDIATE;
+      SET CONSTRAINTS %1$I.sandbox_retained_processes_identity_v2 DEFERRED;
+    END;
+    $function$;
+  $create$, data_schema);
+
+  -- Fixed-shape global inventories use covering partial indexes over only the
+  -- active/draining subsets; retained history and cold/warm lease inventory are
+  -- not scanned by a reaper tick. The application normalizes legacy values into
+  -- its finite label sets.
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.count_active_retained_processes_by_owner_state()
+    RETURNS TABLE (owner_state text, active_count bigint, terminal_owner_count bigint)
+    LANGUAGE sql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+      SELECT inventory.owner_state,
+        pg_catalog.count(*)::bigint AS active_count,
+        pg_catalog.count(*) FILTER (WHERE inventory.terminal_owner)::bigint
+          AS terminal_owner_count
+      FROM (
+        SELECT 'direct'::text AS owner_state, true AS terminal_owner
+        FROM %1$I.sandbox_retained_processes process
+        WHERE process.state = 'active'
+          AND process.owner_actor_kind = 'direct'
+        UNION ALL
+        SELECT COALESCE(turn_row.status, 'missing') AS owner_state,
+          attempt.state = 'closed' AS terminal_owner
+        FROM %1$I.sandbox_retained_processes process
+        LEFT JOIN LATERAL (
+          SELECT source_turn.status
+          FROM %1$I.session_turns source_turn
+          WHERE source_turn.workspace_id = process.workspace_id
+            AND source_turn.id = process.owner_turn_id
+          LIMIT 1
+        ) turn_row ON true
+        LEFT JOIN LATERAL (
+          SELECT source_attempt.state
+          FROM %1$I.session_turn_attempts source_attempt
+          WHERE source_attempt.workspace_id = process.workspace_id
+            AND source_attempt.id = process.owner_attempt_id
+          LIMIT 1
+        ) attempt ON true
+        WHERE process.state = 'active'
+          AND process.owner_actor_kind = 'turn'
+      ) inventory
+      GROUP BY inventory.owner_state;
+    $function$;
+  $create$, data_schema);
+
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.count_expired_draining_sandbox_leases()
+    RETURNS TABLE (backend text, age_bucket text, count bigint)
+    LANGUAGE sql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+      SELECT lease.backend,
+        CASE
+          WHEN pg_catalog.now() - lease.expires_at < interval '5 minutes' THEN 'lt_5m'
+          WHEN pg_catalog.now() - lease.expires_at < interval '1 hour' THEN '5m_1h'
+          WHEN pg_catalog.now() - lease.expires_at < interval '1 day' THEN '1h_1d'
+          ELSE 'gte_1d'
+        END AS age_bucket,
+        pg_catalog.count(*)::bigint
+      FROM %1$I.sandbox_leases lease
+      WHERE lease.liveness = 'draining'
+        AND lease.expires_at < pg_catalog.now()
+      GROUP BY lease.backend, age_bucket;
+    $function$;
+  $create$, data_schema);
+END $privileged_functions$;
+
+-- PostgreSQL grants new functions to PUBLIC by default. These functions bypass
+-- workspace RLS, so only the migration owner and explicit application role may
+-- execute them.
+REVOKE ALL ON FUNCTION opengeni_private.claim_terminal_retained_processes(uuid, integer, bigint)
+  FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.count_active_retained_processes_by_owner_state()
+  FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.count_expired_draining_sandbox_leases()
+  FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_terminal_retained_processes(uuid, integer, bigint)
+      TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION opengeni_private.count_active_retained_processes_by_owner_state()
+      TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION opengeni_private.count_expired_draining_sandbox_leases()
+      TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.12.1",
+  "version": "0.12.6",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,14 +44,15 @@
     "generate": "drizzle-kit generate",
     "migrate": "bun src/migrate.ts",
     "provision-roles": "bun src/provision-roles.ts",
+    "assert-runtime-posture": "bun src/runtime-posture-cli.ts",
     "typecheck": "tsgo --noEmit",
     "build": "tsup",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.1",
-    "@opengeni/contracts": "^0.19.0",
+    "@opengeni/config": "^0.7.6",
+    "@opengeni/contracts": "^0.19.4",
     "@opengeni/network": "^0.1.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"