@opengeni/db 0.14.3 → 0.17.1

package/drizzle/0139_codex_provider_artifact_invalidations.sql

@@ -0,0 +1,51 @@
+-- deployment-mode: rolling
+-- Preserve durable conversation truth while allowing an exact Codex provider
+-- rejection to invalidate only its opaque, provider-bound reasoning artifact.
+-- The item itself remains immutable/auditable; the model read path omits the
+-- rejected identity on the next fenced attempt.
+
+ALTER TABLE "session_history_items"
+  ADD COLUMN "provider_artifact_invalidated_at" timestamptz,
+  ADD COLUMN "provider_artifact_invalidation_reason" text,
+  ADD COLUMN "provider_artifact_invalidated_by_attempt_id" uuid,
+  ADD CONSTRAINT "session_history_items_provider_artifact_invalidation_shape_chk"
+  CHECK (
+    (
+      "provider_artifact_invalidated_at" IS NULL
+      AND "provider_artifact_invalidation_reason" IS NULL
+      AND "provider_artifact_invalidated_by_attempt_id" IS NULL
+    )
+    OR
+    (
+      "provider_artifact_invalidated_at" IS NOT NULL
+      AND "provider_artifact_invalidation_reason" = 'encrypted_content_rejected'
+      AND "provider_artifact_invalidated_by_attempt_id" IS NOT NULL
+      AND "item" ->> 'type' IN ('reasoning', 'compaction')
+    )
+  ) NOT VALID;
+
+ALTER TABLE "agent_run_states"
+  ADD COLUMN "provider_artifact_invalidated_at" timestamptz,
+  ADD COLUMN "provider_artifact_invalidation_reason" text,
+  ADD COLUMN "provider_artifact_invalidated_by_attempt_id" uuid,
+  ADD CONSTRAINT "agent_run_states_provider_artifact_invalidation_shape_chk"
+  CHECK (
+    (
+      "provider_artifact_invalidated_at" IS NULL
+      AND "provider_artifact_invalidation_reason" IS NULL
+      AND "provider_artifact_invalidated_by_attempt_id" IS NULL
+    )
+    OR
+    (
+      "provider_artifact_invalidated_at" IS NOT NULL
+      AND "provider_artifact_invalidation_reason" = 'encrypted_content_rejected'
+      AND "provider_artifact_invalidated_by_attempt_id" IS NOT NULL
+    )
+  ) NOT VALID;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0140_sandbox_restore_and_reaper_fences.sql

@@ -0,0 +1,276 @@
+-- deployment-mode: rolling
+-- A legacy Modal checkpoint is immutable at the generation at which it was
+-- adopted. Restoring it and then writing to the live workspace must advance
+-- workspace_generation without invalidating that checkpoint. Migration 0138
+-- accidentally required archive_generation = workspace_generation forever,
+-- so the first post-restore mutation failed the deferred scope trigger.
+--
+-- The global lease reaper also used one statement snapshot to count holders
+-- before waiting on a concurrently acquired lease row. PostgreSQL could then
+-- apply that stale zero count after the acquire committed, changing a live
+-- lease to draining underneath its new owner. The replacement reaper locks a
+-- bounded, fair batch with SKIP LOCKED first and touches only that exact batch.
+
+DO $checkpoint_ref_validator$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.validate_sandbox_checkpoint_refs()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE checkpoint %1$I.sandbox_checkpoint_artifacts%%ROWTYPE;
+    DECLARE legacy_archive_rebound boolean := false;
+    BEGIN
+      IF TG_OP = 'UPDATE' THEN
+        legacy_archive_rebound :=
+          OLD.current_checkpoint_artifact_id = NEW.current_checkpoint_artifact_id
+          AND OLD.archive_generation IS DISTINCT FROM NEW.archive_generation;
+      END IF;
+
+      IF NEW.current_checkpoint_artifact_id IS NOT NULL THEN
+        SELECT * INTO checkpoint
+        FROM %1$I.sandbox_checkpoint_artifacts
+        WHERE id = NEW.current_checkpoint_artifact_id;
+        IF NOT FOUND
+          OR checkpoint.account_id <> NEW.account_id
+          OR checkpoint.workspace_id <> NEW.workspace_id
+          OR checkpoint.sandbox_group_id <> NEW.sandbox_group_id
+          OR checkpoint.source_lease_id <> NEW.id
+          OR checkpoint.provider_backend <> NEW.backend
+          OR (
+            checkpoint.provenance = 'native_capture'
+            AND checkpoint.source_workspace_generation
+              IS DISTINCT FROM NEW.archive_generation
+          )
+          OR (
+            checkpoint.provenance = 'legacy_provider_adopted'
+            AND (
+              NEW.archive_generation IS NULL
+              OR legacy_archive_rebound
+            )
+          )
+          OR checkpoint.archive_base64
+            IS DISTINCT FROM NEW.resume_state #>> '{sessionState,workspaceArchive}'
+          OR checkpoint.descriptor_revision
+            IS DISTINCT FROM NEW.resume_state #>> '{sessionState,workspaceArchiveMeta,revision}'
+          OR checkpoint.state <> 'current'
+        THEN
+          RAISE EXCEPTION 'current checkpoint artifact does not match its exact lease scope'
+            USING ERRCODE = '23514';
+        END IF;
+      END IF;
+
+      IF NEW.previous_checkpoint_artifact_id IS NOT NULL THEN
+        SELECT * INTO checkpoint
+        FROM %1$I.sandbox_checkpoint_artifacts
+        WHERE id = NEW.previous_checkpoint_artifact_id;
+        IF NOT FOUND
+          OR checkpoint.account_id <> NEW.account_id
+          OR checkpoint.workspace_id <> NEW.workspace_id
+          OR checkpoint.sandbox_group_id <> NEW.sandbox_group_id
+          OR checkpoint.source_lease_id <> NEW.id
+          OR checkpoint.provider_backend <> NEW.backend
+          OR checkpoint.archive_base64
+            IS DISTINCT FROM NEW.resume_state #>> '{sessionState,workspaceArchivePrev}'
+          OR checkpoint.descriptor_revision
+            IS DISTINCT FROM NEW.resume_state #>> '{sessionState,workspaceArchivePrevMeta,revision}'
+          OR checkpoint.state <> 'previous'
+        THEN
+          RAISE EXCEPTION 'previous checkpoint artifact does not match its exact lease scope'
+            USING ERRCODE = '23514';
+        END IF;
+      END IF;
+      RETURN NEW;
+    END;
+    $function$;
+  $create$, data_schema);
+END
+$checkpoint_ref_validator$;
+
+DO $bounded_lock_first_reaper$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.reap_sandbox_leases(
+      p_viewer_holder_ttl_ms bigint,
+      p_turn_holder_ttl_ms bigint,
+      p_idle_grace_ms bigint
+    )
+    RETURNS TABLE (
+      workspace_id uuid,
+      sandbox_group_id uuid,
+      instance_id text,
+      lease_epoch integer
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE locked_ids uuid[];
+    BEGIN
+      PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+
+      -- Every holder-creating runtime path locks its lease first. SKIP LOCKED
+      -- therefore gives one coherent statement snapshot without ever waiting
+      -- behind an acquire and later publishing pre-wait counts. Old/corrupt
+      -- cold rows carrying holders are included for bounded repair. Updating
+      -- selected rows' updated_at below rotates a backlog fairly.
+      SELECT coalesce(
+        pg_catalog.array_agg(candidate.id),
+        ARRAY[]::uuid[]
+      )
+      INTO locked_ids
+      FROM (
+        SELECT lease.id
+        FROM %1$I.sandbox_leases lease
+        WHERE lease.liveness <> 'cold'
+          OR EXISTS (
+            SELECT 1
+            FROM %1$I.sandbox_lease_holders holder
+            WHERE holder.lease_id = lease.id
+          )
+        ORDER BY lease.updated_at, lease.id
+        LIMIT 500
+        FOR UPDATE OF lease SKIP LOCKED
+      ) candidate;
+
+      IF pg_catalog.cardinality(locked_ids) = 0 THEN
+        RETURN;
+      END IF;
+
+      -- A legacy heartbeat/force-drain writer can still hold an individual
+      -- holder row during a rolling rollout. Lock stale victims with SKIP
+      -- LOCKED as well, avoiding a holder->lease / lease->holder deadlock.
+      DELETE FROM %1$I.sandbox_lease_holders holder
+      USING (
+        SELECT stale.id
+        FROM %1$I.sandbox_lease_holders stale
+        WHERE stale.lease_id = ANY(locked_ids)
+          AND stale.kind IN ('viewer', 'direct')
+          AND stale.last_heartbeat_at
+            < pg_catalog.now()
+              - pg_catalog.make_interval(secs => p_viewer_holder_ttl_ms / 1000.0)
+        FOR UPDATE OF stale SKIP LOCKED
+      ) victim
+      WHERE holder.id = victim.id;
+
+      IF p_turn_holder_ttl_ms > 0 THEN
+        DELETE FROM %1$I.sandbox_lease_holders holder
+        USING (
+          SELECT stale.id
+          FROM %1$I.sandbox_lease_holders stale
+          WHERE stale.lease_id = ANY(locked_ids)
+            AND stale.kind = 'turn'
+            AND stale.last_heartbeat_at
+              < pg_catalog.now()
+                - pg_catalog.make_interval(secs => p_turn_holder_ttl_ms / 1000.0)
+          FOR UPDATE OF stale SKIP LOCKED
+        ) victim
+        WHERE holder.id = victim.id;
+      END IF;
+
+      UPDATE %1$I.sandbox_leases lease SET
+        refcount = counts.total,
+        turn_holders = counts.turns,
+        viewer_holders = counts.viewers,
+        liveness = CASE
+          WHEN lease.liveness = 'warm' AND counts.total = 0 AND counts.turns = 0
+          THEN 'draining' ELSE lease.liveness END,
+        expires_at = CASE
+          WHEN lease.liveness = 'warm' AND counts.total = 0 AND counts.turns = 0
+          THEN CASE
+            WHEN lease.rotation_requested_at IS NOT NULL
+            THEN pg_catalog.now() - interval '1 millisecond'
+            ELSE pg_catalog.now()
+              + pg_catalog.make_interval(secs => p_idle_grace_ms / 1000.0)
+          END
+          ELSE lease.expires_at END,
+        updated_at = pg_catalog.now()
+      FROM (
+        SELECT candidate.id,
+          pg_catalog.count(holder.id)::int AS total,
+          pg_catalog.count(holder.id)
+            FILTER (WHERE holder.kind = 'turn')::int AS turns,
+          pg_catalog.count(holder.id)
+            FILTER (WHERE holder.kind = 'viewer')::int AS viewers
+        FROM pg_catalog.unnest(locked_ids) candidate(id)
+        LEFT JOIN %1$I.sandbox_lease_holders holder
+          ON holder.lease_id = candidate.id
+        GROUP BY candidate.id
+      ) counts
+      WHERE lease.id = counts.id;
+
+      UPDATE %1$I.sandbox_leases lease SET
+        liveness = 'cold',
+        instance_id = null,
+        lease_epoch = lease.lease_epoch + 1,
+        resume_state = opengeni_private.warming_reset_resume_state_v2(
+          lease.backend,
+          lease.resume_backend_id,
+          lease.resume_state,
+          lease.workspace_generation,
+          lease.archive_generation,
+          pg_catalog.clock_timestamp()
+        ),
+        resume_backend_id = CASE
+          WHEN coalesce(
+            lease.resume_state #>> '{sessionState,workspaceArchive}', ''
+          ) <> ''
+            OR coalesce(
+              lease.resume_state #>> '{sessionState,workspaceArchivePrev}', ''
+            ) <> ''
+          THEN coalesce(lease.resume_backend_id, lease.backend)
+          ELSE null END,
+        data_plane_url = null,
+        terminal_data_plane_url = null,
+        provider_created_at = null,
+        provider_deadline_at = null,
+        rotation_requested_at = null,
+        rotation_reason = null,
+        updated_at = pg_catalog.now()
+      WHERE lease.id = ANY(locked_ids)
+        AND lease.liveness = 'warming'
+        AND lease.expires_at < pg_catalog.now()
+        AND lease.instance_id IS NULL;
+
+      UPDATE %1$I.sandbox_leases lease SET
+        liveness = 'draining',
+        refcount = 0,
+        turn_holders = 0,
+        viewer_holders = 0,
+        data_plane_url = null,
+        terminal_data_plane_url = null,
+        lease_epoch = lease.lease_epoch + 1,
+        expires_at = pg_catalog.now() - interval '1 millisecond',
+        updated_at = pg_catalog.now()
+      WHERE lease.id = ANY(locked_ids)
+        AND lease.liveness = 'warming'
+        AND lease.expires_at < pg_catalog.now()
+        AND lease.instance_id IS NOT NULL;
+
+      RETURN QUERY
+        SELECT lease.workspace_id, lease.sandbox_group_id,
+          lease.instance_id, lease.lease_epoch
+        FROM %1$I.sandbox_leases lease
+        WHERE lease.id = ANY(locked_ids)
+          AND lease.liveness = 'draining'
+          AND lease.expires_at < pg_catalog.now()
+          AND lease.refcount = 0;
+    END;
+    $function$;
+  $create$, data_schema);
+END
+$bounded_lock_first_reaper$;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.reap_sandbox_leases(bigint, bigint, bigint)
+      TO opengeni_app;
+  END IF;
+END
+$grants$;

package/drizzle/0142_sandbox_archive_capture_gate.sql

@@ -0,0 +1,80 @@
+-- deployment-mode: maintenance
+-- A provider-native workspace snapshot pauses the Modal container while it is
+-- captured. The previous generation preflight prevented a stale snapshot from
+-- being published, but it did not prevent a new provider command from being
+-- admitted after preflight and rejected by Modal while the container was
+-- paused. Activate one durable lease-local capture gate that both snapshot
+-- paths claim before provider I/O and every holder/mutation path honors.
+--
+-- Old application workers do not honor this gate. Stop every opengeni_app
+-- session before activation and never restart a pre-0142 image afterward.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30min';
+
+DO $maintenance_preflight_guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app')
+    AND EXISTS (
+      SELECT 1
+      FROM pg_stat_activity
+      WHERE datname = current_database()
+        AND usename = 'opengeni_app'
+        AND pid <> pg_backend_pid()
+    )
+  THEN
+    RAISE EXCEPTION
+      'sandbox archive-capture gate activation requires all opengeni_app sessions to be stopped'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$maintenance_preflight_guard$;
+
+LOCK TABLE sandbox_leases IN ACCESS EXCLUSIVE MODE;
+
+DO $maintenance_guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app')
+    AND EXISTS (
+      SELECT 1
+      FROM pg_stat_activity
+      WHERE datname = current_database()
+        AND usename = 'opengeni_app'
+        AND pid <> pg_backend_pid()
+    )
+  THEN
+    RAISE EXCEPTION
+      'sandbox archive-capture gate activation requires all opengeni_app sessions to be stopped'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$maintenance_guard$;
+
+ALTER TABLE sandbox_leases
+  ADD COLUMN archive_capture_id uuid,
+  ADD COLUMN archive_capture_generation integer,
+  ADD COLUMN archive_capture_started_at timestamptz,
+  ADD COLUMN archive_capture_deadline_at timestamptz;
+
+ALTER TABLE sandbox_leases
+  ADD CONSTRAINT sandbox_leases_archive_capture_check
+  CHECK (
+    (
+      archive_capture_id IS NULL
+      AND archive_capture_generation IS NULL
+      AND archive_capture_started_at IS NULL
+      AND archive_capture_deadline_at IS NULL
+    )
+    OR
+    (
+      archive_capture_id IS NOT NULL
+      AND archive_capture_generation IS NOT NULL
+      AND archive_capture_generation = workspace_generation
+      AND archive_capture_started_at IS NOT NULL
+      AND archive_capture_deadline_at > archive_capture_started_at
+    )
+  );
+
+CREATE INDEX sandbox_leases_archive_capture_deadline_idx
+  ON sandbox_leases (archive_capture_deadline_at, id)
+  WHERE archive_capture_id IS NOT NULL;

package/drizzle/0143_session_codex_compaction_mode.sql

@@ -0,0 +1,20 @@
+-- deployment-mode: rolling
+-- Freeze each session's Codex compaction strategy at create time.
+-- Existing sessions stay on portable plaintext compaction so mid-session
+-- provider switches remain available; new Codex sessions default to remote_v2
+-- unless the workspace opts into portable.
+
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "codex_compaction_mode" text NOT NULL DEFAULT 'portable';
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT IF EXISTS "sessions_codex_compaction_mode_chk";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_codex_compaction_mode_chk"
+  CHECK ("codex_compaction_mode" IN ('remote_v2', 'portable'));
+
+UPDATE "sessions"
+SET "codex_compaction_mode" = 'portable'
+WHERE "codex_compaction_mode" IS DISTINCT FROM 'portable'
+  AND "codex_compaction_mode" IS DISTINCT FROM 'remote_v2';

package/drizzle/0144_sandbox_viewer_force_drain_gate.sql

@@ -0,0 +1,95 @@
+-- deployment-mode: maintenance
+-- A workspace that has exhausted its managed-credit balance or monthly warm
+-- allowance must not let an open dashboard immediately re-arm a viewer-only
+-- sandbox during the drain grace. Persist that admission intent independently
+-- of any one lease so it survives provider teardown and a cold successor row.
+
+SET LOCAL lock_timeout = '5s';
+-- Old application processes do not honor this new workspace gate. Activate it
+-- only while the maintenance operator has stopped every opengeni_app session.
+SET LOCAL statement_timeout = '30min';
+
+DO $maintenance_preflight_guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app')
+    AND EXISTS (
+      SELECT 1
+      FROM pg_stat_activity
+      WHERE datname = current_database()
+        AND usename = 'opengeni_app'
+        AND pid <> pg_backend_pid()
+    )
+  THEN
+    RAISE EXCEPTION
+      'sandbox viewer force-drain gate activation requires all opengeni_app sessions to be stopped'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$maintenance_preflight_guard$;
+
+LOCK TABLE workspaces IN ACCESS EXCLUSIVE MODE;
+
+DO $maintenance_guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app')
+    AND EXISTS (
+      SELECT 1
+      FROM pg_stat_activity
+      WHERE datname = current_database()
+        AND usename = 'opengeni_app'
+        AND pid <> pg_backend_pid()
+    )
+  THEN
+    RAISE EXCEPTION
+      'sandbox viewer force-drain gate activation requires all opengeni_app sessions to be stopped'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$maintenance_guard$;
+
+ALTER TABLE workspaces
+  ADD COLUMN sandbox_viewer_force_drain_reason text,
+  ADD COLUMN sandbox_viewer_force_drain_requested_at timestamptz;
+
+ALTER TABLE workspaces
+  ADD CONSTRAINT workspaces_sandbox_viewer_force_drain_check
+  CHECK (
+    (
+      sandbox_viewer_force_drain_reason IS NULL
+      AND sandbox_viewer_force_drain_requested_at IS NULL
+    )
+    OR
+    (
+      sandbox_viewer_force_drain_reason IN ('balance', 'warm_cap')
+      AND sandbox_viewer_force_drain_requested_at IS NOT NULL
+    )
+  );
+
+CREATE INDEX workspaces_sandbox_viewer_force_drain_idx
+  ON workspaces (id)
+  WHERE sandbox_viewer_force_drain_reason IS NOT NULL;
+
+-- The global sandbox reaper must keep reevaluating a persisted admission gate
+-- after every affected lease becomes cold. Returning workspace identity only
+-- keeps billing values and tenant data behind their existing scoped reads.
+CREATE OR REPLACE FUNCTION opengeni_private.list_sandbox_viewer_force_drain_workspaces()
+RETURNS TABLE (workspace_id uuid)
+LANGUAGE sql
+SECURITY DEFINER
+-- EMBED-SAFE: inherit the caller's target-schema search_path, matching the
+-- existing cross-workspace sandbox inventory functions.
+AS $$
+  SELECT W.id
+  FROM workspaces W
+  WHERE W.sandbox_viewer_force_drain_reason IS NOT NULL
+  ORDER BY W.id;
+$$;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE
+      ON FUNCTION opengeni_private.list_sandbox_viewer_force_drain_workspaces()
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0145_model_call_facts.sql

@@ -0,0 +1,96 @@
+-- deployment-mode: rolling
+-- Additive Workspace Insights fact table for per-model-call tokens/cache/provider
+-- pivots. Written only after an authoritative agent.model.usage emit; never widens
+-- the billing usage_events ledger. FORCE RLS matches usage_events isolation.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE IF NOT EXISTS "model_call_facts" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "session_id" uuid NOT NULL,
+  "turn_id" uuid NOT NULL,
+  "turn_attempt_id" uuid,
+  "source_key" text NOT NULL,
+  "provider" text NOT NULL,
+  "provider_api" text NOT NULL,
+  "model" text NOT NULL,
+  "billing_path" text NOT NULL,
+  "turn_source" text,
+  "initiator_kind" text,
+  "initiator_subject_id" text,
+  "scheduled_task_id" uuid,
+  "input_tokens" bigint,
+  "output_tokens" bigint,
+  "cached_tokens" bigint,
+  "cache_write_tokens" bigint,
+  "reasoning_tokens" bigint,
+  "total_tokens" bigint,
+  "priced_cost_micros" bigint NOT NULL DEFAULT 0,
+  "occurred_at" timestamptz NOT NULL,
+  "recorded_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "model_call_facts_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "model_call_facts_billing_path_check"
+    CHECK ("billing_path" IN ('opengeni_credits', 'external')),
+  CONSTRAINT "model_call_facts_priced_cost_check"
+    CHECK ("priced_cost_micros" >= 0),
+  CONSTRAINT "model_call_facts_initiator_check"
+    CHECK (
+      ("initiator_kind" IS NULL AND "initiator_subject_id" IS NULL)
+      OR (
+        "initiator_kind" IN ('subject', 'service')
+        AND "initiator_subject_id" IS NOT NULL
+        AND octet_length("initiator_subject_id") BETWEEN 1 AND 1024
+      )
+    ),
+  CONSTRAINT "model_call_facts_source_key_bytes_check"
+    CHECK (octet_length("source_key") BETWEEN 1 AND 1024),
+  CONSTRAINT "model_call_facts_provider_bytes_check"
+    CHECK (octet_length("provider") BETWEEN 1 AND 256),
+  CONSTRAINT "model_call_facts_provider_api_bytes_check"
+    CHECK (octet_length("provider_api") BETWEEN 1 AND 256),
+  CONSTRAINT "model_call_facts_model_bytes_check"
+    CHECK (octet_length("model") BETWEEN 1 AND 512)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "model_call_facts_workspace_turn_source_uq"
+  ON "model_call_facts" ("workspace_id", "turn_id", "source_key");
+
+CREATE INDEX IF NOT EXISTS "model_call_facts_workspace_occurred_idx"
+  ON "model_call_facts" ("workspace_id", "occurred_at");
+
+CREATE INDEX IF NOT EXISTS "model_call_facts_workspace_provider_model_occurred_idx"
+  ON "model_call_facts" ("workspace_id", "provider", "model", "occurred_at");
+
+CREATE INDEX IF NOT EXISTS "model_call_facts_workspace_session_occurred_idx"
+  ON "model_call_facts" ("workspace_id", "session_id", "occurred_at");
+
+CREATE INDEX IF NOT EXISTS "model_call_facts_workspace_scheduled_task_occurred_idx"
+  ON "model_call_facts" ("workspace_id", "scheduled_task_id", "occurred_at")
+  WHERE "scheduled_task_id" IS NOT NULL;
+
+ALTER TABLE "model_call_facts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "model_call_facts" FORCE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "model_call_facts_account_workspace_isolation" ON "model_call_facts";
+CREATE POLICY "model_call_facts_account_workspace_isolation" ON "model_call_facts"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.model_call_facts TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END $grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;