@opengeni/db 0.28.9 → 0.36.0

package/drizzle/0219_site_auth_maintenance_sessions.sql

@@ -0,0 +1,234 @@
+-- deployment-mode: maintenance
+-- Crash-safe SiteAuth maintenance claims. A claim owns one hidden session id
+-- and one operation id; retries repair the same session rather than dispatching
+-- duplicate health or repair agents.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+ALTER TABLE "site_auth_connections"
+  ADD COLUMN "maintenance_operation_id" uuid,
+  ADD COLUMN "maintenance_action" text,
+  ADD COLUMN "maintenance_due_at" timestamptz,
+  ADD COLUMN "maintenance_claimed_at" timestamptz,
+  ADD COLUMN "maintenance_session_id" uuid,
+  ADD COLUMN "maintenance_started_at" timestamptz;
+
+ALTER TABLE "site_auth_connections"
+  ADD CONSTRAINT "site_auth_connections_maintenance_check" CHECK (
+    (
+      "maintenance_operation_id" IS NULL
+      AND "maintenance_action" IS NULL
+      AND "maintenance_due_at" IS NULL
+      AND "maintenance_claimed_at" IS NULL
+      AND "maintenance_session_id" IS NULL
+      AND "maintenance_started_at" IS NULL
+    ) OR (
+      "status" = 'active'
+      AND "health_policy"->>'mode' = 'maintained'
+      AND "maintenance_operation_id" IS NOT NULL
+      AND "maintenance_action" IN ('health_check', 'repair')
+      AND "maintenance_due_at" IS NOT NULL
+      AND "maintenance_claimed_at" IS NOT NULL
+      AND "maintenance_session_id" IS NOT NULL
+      AND (
+        "maintenance_started_at" IS NULL
+        OR "maintenance_started_at" >= "maintenance_due_at"
+      )
+    )
+  );
+
+ALTER TABLE "auth_runs"
+  ADD COLUMN "maintenance_operation_id" uuid,
+  ADD CONSTRAINT "auth_runs_maintenance_check" CHECK (
+    "maintenance_operation_id" IS NULL
+    OR "purpose" IN ('health_check', 'repair')
+  );
+
+DROP INDEX "site_auth_connections_health_maintenance_idx";
+CREATE INDEX "site_auth_connections_health_maintenance_idx"
+  ON "site_auth_connections" (
+    "next_check_at", "maintenance_claimed_at", "id"
+  );
+
+CREATE UNIQUE INDEX "auth_runs_workspace_maintenance_operation_uq"
+  ON "auth_runs" ("workspace_id", "maintenance_operation_id")
+  WHERE "maintenance_operation_id" IS NOT NULL;
+
+-- Sole cross-workspace claim boundary. An undispatched stale claim reuses its
+-- exact ids. A completed/failed maintenance session without a live AuthRun is
+-- replaced only after the claim timeout. Active sessions and interventions are
+-- never stolen.
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_site_auth_maintenance(
+      p_claim_timeout_ms bigint,
+      p_limit integer
+    )
+    RETURNS TABLE (
+      operation_id uuid,
+      session_id uuid,
+      account_id uuid,
+      workspace_id uuid,
+      site_auth_connection_id uuid,
+      connection_version bigint,
+      action text,
+      due_at timestamptz,
+      claimed_at timestamptz,
+      name text,
+      account_label text,
+      login_url text,
+      verification_url_prefixes jsonb,
+      preferred_identity_id uuid,
+      preferred_placement jsonb,
+      preferred_network_route_id uuid,
+      health_policy jsonb,
+      verification_state text
+    )
+    LANGUAGE sql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+      WITH candidates AS MATERIALIZED (
+        SELECT
+          C.id,
+          C.maintenance_operation_id,
+          C.maintenance_session_id,
+          C.maintenance_started_at,
+          S.status AS session_status
+        FROM %1$I.site_auth_connections C
+        LEFT JOIN %1$I.sessions S
+          ON S.workspace_id = C.workspace_id
+          AND S.id = C.maintenance_session_id
+        WHERE C.status = 'active'
+          AND C.health_policy->>'mode' = 'maintained'
+          AND C.next_check_at <= clock_timestamp()
+          AND (
+            C.maintenance_operation_id IS NULL
+            OR (
+              C.maintenance_started_at IS NULL
+              AND C.maintenance_claimed_at <= clock_timestamp() - (
+                greatest(coalesce(p_claim_timeout_ms, 0), 0)::double precision * interval '1 millisecond'
+              )
+            )
+            OR (
+              C.maintenance_started_at IS NOT NULL
+              AND S.status = 'queued'
+              AND NOT EXISTS (
+                SELECT 1
+                FROM %1$I.auth_runs R
+                WHERE R.workspace_id = C.workspace_id
+                  AND R.maintenance_operation_id = C.maintenance_operation_id
+                  AND R.settled_at IS NULL
+              )
+              AND C.maintenance_claimed_at <= clock_timestamp() - (
+                greatest(coalesce(p_claim_timeout_ms, 0), 0)::double precision * interval '1 millisecond'
+              )
+            )
+            OR (
+              C.maintenance_started_at IS NOT NULL
+              AND (S.id IS NULL OR S.status IN ('idle', 'failed', 'cancelled'))
+              AND NOT EXISTS (
+                SELECT 1
+                FROM %1$I.auth_runs R
+                WHERE R.workspace_id = C.workspace_id
+                  AND R.maintenance_operation_id = C.maintenance_operation_id
+                  AND R.settled_at IS NULL
+              )
+              AND C.maintenance_claimed_at <= clock_timestamp() - (
+                greatest(coalesce(p_claim_timeout_ms, 0), 0)::double precision * interval '1 millisecond'
+              )
+            )
+          )
+        ORDER BY C.next_check_at, C.id
+        LIMIT least(greatest(coalesce(p_limit, 0), 0), 1000)
+        FOR UPDATE OF C SKIP LOCKED
+      ), prepared AS (
+        SELECT
+          X.id,
+          CASE
+            WHEN X.maintenance_operation_id IS NOT NULL
+              AND (
+                X.maintenance_started_at IS NULL
+                OR X.session_status = 'queued'
+              )
+              THEN X.maintenance_operation_id
+            ELSE gen_random_uuid()
+          END AS operation_id,
+          CASE
+            WHEN X.maintenance_session_id IS NOT NULL
+              AND (
+                X.maintenance_started_at IS NULL
+                OR X.session_status = 'queued'
+              )
+              THEN X.maintenance_session_id
+            ELSE gen_random_uuid()
+          END AS session_id
+        FROM candidates X
+      ), claimed AS (
+        UPDATE %1$I.site_auth_connections C
+        SET
+          maintenance_operation_id = P.operation_id,
+          maintenance_action = CASE
+            WHEN C.verification_state IN ('needs_repair', 'failed')
+              AND (C.health_policy->>'automaticRepair')::boolean
+              THEN 'repair'
+            ELSE 'health_check'
+          END,
+          maintenance_due_at = C.next_check_at,
+          maintenance_claimed_at = clock_timestamp(),
+          maintenance_session_id = P.session_id,
+          maintenance_started_at = NULL,
+          version = C.version + 1,
+          updated_by_subject_id = 'site-auth-maintenance',
+          updated_at = clock_timestamp()
+        FROM prepared P
+        WHERE C.id = P.id
+        RETURNING C.*
+      ), revisions AS (
+        INSERT INTO %1$I.workspace_interaction_revisions (
+          workspace_id, account_id, revision, updated_at
+        )
+        SELECT DISTINCT C.workspace_id, C.account_id, 1, clock_timestamp()
+        FROM claimed C
+        ON CONFLICT (workspace_id) DO UPDATE
+        SET revision = %1$I.workspace_interaction_revisions.revision + 1,
+          updated_at = excluded.updated_at
+        RETURNING workspace_id
+      )
+      SELECT
+        C.maintenance_operation_id,
+        C.maintenance_session_id,
+        C.account_id,
+        C.workspace_id,
+        C.id,
+        C.version,
+        C.maintenance_action,
+        C.maintenance_due_at,
+        C.maintenance_claimed_at,
+        C.name,
+        C.account_label,
+        C.login_url,
+        C.verification_url_prefixes,
+        C.preferred_identity_id,
+        C.preferred_placement,
+        C.preferred_network_route_id,
+        C.health_policy,
+        C.verification_state
+      FROM claimed C;
+    $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.claim_site_auth_maintenance(bigint, integer)
+  FROM PUBLIC;
+
+DO $site_auth_maintenance_role_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_site_auth_maintenance(bigint, integer)
+      TO opengeni_app;
+  END IF;
+END
+$site_auth_maintenance_role_grants$;

package/drizzle/0220_memory_slack_append_only_cascade.sql

@@ -0,0 +1,38 @@
+-- deployment-mode: rolling
+SET lock_timeout = '5s';
+SET statement_timeout = '30s';
+
+-- Configuration revisions and delivery receipts remain immutable while their
+-- workspace exists. Parent account/workspace deletion must still be able to
+-- cascade through that history, including on embedded non-public schemas.
+CREATE OR REPLACE FUNCTION opengeni_private.reject_memory_slack_immutable_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  workspace_exists boolean;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    IF pg_trigger_depth() > 1 THEN
+      RETURN OLD;
+    END IF;
+
+    EXECUTE format(
+      'SELECT EXISTS (SELECT 1 FROM %I.workspaces WHERE id = $1)',
+      TG_TABLE_SCHEMA
+    )
+      INTO workspace_exists
+      USING OLD.workspace_id;
+    IF NOT workspace_exists THEN
+      RETURN OLD;
+    END IF;
+  END IF;
+
+  RAISE EXCEPTION '% is append-only', TG_TABLE_NAME USING ERRCODE = '55000';
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION opengeni_private.reject_memory_slack_immutable_mutation()
+  FROM PUBLIC;

package/drizzle/0220_session_channels.sql

@@ -0,0 +1,54 @@
+-- deployment-mode: rolling
+
+-- Workspace-shared channels organize root sessions ("workstreams") by work
+-- type in the rail. A channel is pure organizational metadata: filing a
+-- session into one never affects execution, authority, memory, or history,
+-- and deleting a channel only detaches its sessions (channel_id -> NULL).
+CREATE TABLE "channels" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "name" text NOT NULL,
+  "description" text,
+  -- Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
+  "created_by" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "channels_name_chk"
+    CHECK (length(btrim("name")) BETWEEN 1 AND 80 AND "name" = btrim("name")),
+  CONSTRAINT "channels_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "channels_workspace_name_idx"
+  ON "channels" ("workspace_id", lower("name"));
+CREATE UNIQUE INDEX "channels_workspace_id_uq"
+  ON "channels" ("workspace_id", "id");
+
+ALTER TABLE "channels" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "channels" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "channels"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.channels TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END
+$grants$;
+
+-- A root session may be filed into one channel; NULL means unfiled (the
+-- inbox). Keep this transaction to the metadata-only nullable column addition:
+-- both the supporting index and the foreign-key validation need table scans,
+-- so migrations 0221-0223 perform those steps without retaining this ADD
+-- COLUMN transaction's ACCESS EXCLUSIVE lock for the duration of a scan.
+SET LOCAL lock_timeout = '5s';
+ALTER TABLE "sessions"
+  ADD COLUMN "channel_id" uuid;

package/drizzle/0221_sessions_channel_index.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "sessions_workspace_channel_idx"
+  ON "sessions" ("workspace_id", "channel_id")
+  WHERE "channel_id" IS NOT NULL;

package/drizzle/0222_session_visibility_authority_epochs.sql

@@ -0,0 +1,158 @@
+-- deployment-mode: rolling
+-- Activate the existing Slice-A session tenancy facts at the accepted-attempt
+-- boundary. This migration is additive: legacy rows remain workspace-shared at
+-- epoch 1, while new claim writers persist the exact session authority they
+-- admitted.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "session_turn_attempts"
+  ADD COLUMN IF NOT EXISTS "authority_epoch" integer,
+  ADD COLUMN IF NOT EXISTS "authority_visibility" text,
+  ADD COLUMN IF NOT EXISTS "authority_owner_organization_membership_id" uuid;
+
+UPDATE "session_turn_attempts" attempts
+SET
+  authority_epoch = sessions.authority_epoch,
+  authority_visibility = sessions.visibility,
+  authority_owner_organization_membership_id = sessions.owner_organization_membership_id
+FROM "sessions" sessions
+WHERE sessions.workspace_id = attempts.workspace_id
+  AND sessions.id = attempts.session_id;
+
+DO $session_visibility_attempt_compatibility$
+DECLARE
+  data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION %1$I.session_turn_attempts_fill_authority_snapshot()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $body$
+    DECLARE
+      workspace_marker boolean;
+      source_epoch integer;
+      source_visibility text;
+      source_owner uuid;
+    BEGIN
+      SELECT true
+      INTO STRICT workspace_marker
+      FROM %1$I.workspaces workspace_row
+      WHERE workspace_row.id = NEW.workspace_id
+        AND workspace_row.account_id = NEW.account_id
+      FOR KEY SHARE;
+
+      SELECT
+        source.authority_epoch,
+        source.visibility,
+        source.owner_organization_membership_id
+      INTO STRICT source_epoch, source_visibility, source_owner
+      FROM %1$I.sessions source
+      WHERE source.workspace_id = NEW.workspace_id
+        AND source.account_id = NEW.account_id
+        AND source.id = NEW.session_id
+      FOR UPDATE;
+
+      NEW.authority_epoch := source_epoch;
+      NEW.authority_visibility := source_visibility;
+      NEW.authority_owner_organization_membership_id := source_owner;
+      RETURN NEW;
+    EXCEPTION
+      WHEN NO_DATA_FOUND THEN
+        RAISE EXCEPTION 'session authority snapshot source workspace/session not found: %%/%%',
+          NEW.workspace_id, NEW.session_id
+          USING ERRCODE = '23503';
+    END;
+    $body$;
+  $ddl$, data_schema);
+
+  EXECUTE format(
+    'DROP TRIGGER IF EXISTS session_turn_attempts_fill_authority_snapshot_trg ON %I.session_turn_attempts',
+    data_schema
+  );
+  EXECUTE format($ddl$
+    CREATE TRIGGER session_turn_attempts_fill_authority_snapshot_trg
+    BEFORE INSERT ON %1$I.session_turn_attempts
+    FOR EACH ROW
+    WHEN (
+      NEW.authority_epoch IS NULL
+      AND NEW.authority_visibility IS NULL
+      AND NEW.authority_owner_organization_membership_id IS NULL
+    )
+    EXECUTE FUNCTION %1$I.session_turn_attempts_fill_authority_snapshot()
+  $ddl$, data_schema);
+END;
+$session_visibility_attempt_compatibility$;
+
+ALTER TABLE "session_turn_attempts"
+  ADD CONSTRAINT "session_turn_attempts_authority_epoch_check"
+    CHECK (
+      "authority_epoch" IS NOT NULL
+      AND "authority_visibility" IS NOT NULL
+      AND "authority_epoch" > 0
+    ) NOT VALID,
+  ADD CONSTRAINT "session_turn_attempts_authority_visibility_check"
+    CHECK (
+      "authority_epoch" IS NOT NULL
+      AND "authority_visibility" IS NOT NULL
+      AND "authority_visibility" IN ('user_private', 'workspace_shared')
+    ) NOT VALID,
+  ADD CONSTRAINT "session_turn_attempts_authority_owner_shape_check"
+    CHECK (
+      "authority_visibility" <> 'user_private'
+      OR "authority_owner_organization_membership_id" IS NOT NULL
+    ) NOT VALID,
+  ADD CONSTRAINT "session_turn_attempts_authority_owner_fk"
+    FOREIGN KEY ("authority_owner_organization_membership_id", "account_id")
+    REFERENCES "organization_memberships"("id", "account_id")
+    ON DELETE RESTRICT NOT VALID;
+
+ALTER TABLE "session_turn_attempts"
+  VALIDATE CONSTRAINT "session_turn_attempts_authority_epoch_check",
+  VALIDATE CONSTRAINT "session_turn_attempts_authority_visibility_check",
+  VALIDATE CONSTRAINT "session_turn_attempts_authority_owner_shape_check",
+  VALIDATE CONSTRAINT "session_turn_attempts_authority_owner_fk";
+
+ALTER TABLE "session_turn_attempts"
+  ALTER COLUMN "authority_epoch" SET NOT NULL,
+  ALTER COLUMN "authority_visibility" SET NOT NULL;
+
+CREATE INDEX IF NOT EXISTS "session_turn_attempts_authority_epoch_idx"
+  ON "session_turn_attempts" ("workspace_id", "session_id", "authority_epoch");
+
+DO $session_visibility_attempt_immutability$
+DECLARE
+  data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION %1$I.session_turn_attempts_guard_authority_snapshot_immutable()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $body$
+    BEGIN
+      IF NEW.authority_epoch IS DISTINCT FROM OLD.authority_epoch
+        OR NEW.authority_visibility IS DISTINCT FROM OLD.authority_visibility
+        OR NEW.authority_owner_organization_membership_id IS DISTINCT FROM OLD.authority_owner_organization_membership_id
+      THEN
+        RAISE EXCEPTION 'session turn attempt authority snapshot is immutable'
+          USING ERRCODE = '23514';
+      END IF;
+      RETURN NEW;
+    END;
+    $body$;
+  $ddl$, data_schema);
+
+  EXECUTE format(
+    'DROP TRIGGER IF EXISTS session_turn_attempts_guard_authority_snapshot_immutable_trg ON %I.session_turn_attempts',
+    data_schema
+  );
+  EXECUTE format($ddl$
+    CREATE TRIGGER session_turn_attempts_guard_authority_snapshot_immutable_trg
+    BEFORE UPDATE OF authority_epoch, authority_visibility, authority_owner_organization_membership_id
+      ON %1$I.session_turn_attempts
+    FOR EACH ROW
+    EXECUTE FUNCTION %1$I.session_turn_attempts_guard_authority_snapshot_immutable()
+  $ddl$, data_schema);
+END;
+$session_visibility_attempt_immutability$;

package/drizzle/0222_sessions_channel_fk.sql

@@ -0,0 +1,89 @@
+-- deployment-mode: rolling
+-- Install the channel foreign key without scanning the populated sessions
+-- table while holding ACCESS EXCLUSIVE. New writes are checked immediately;
+-- migration 0223 performs the bounded online validation scan separately.
+--
+-- The equivalent auto-named constraint may already exist on a database that
+-- applied the original unreleased 0220 migration. Preserve that validated
+-- constraint only when its complete catalog semantics match this migration.
+SET LOCAL lock_timeout = '5s';
+
+DO $migration$
+DECLARE
+  same_name_count integer;
+  exact_count integer;
+BEGIN
+  SELECT count(*)::integer
+  INTO same_name_count
+  FROM pg_catalog.pg_constraint AS constraint_row
+  WHERE constraint_row.conrelid = 'sessions'::regclass
+    AND constraint_row.conname IN ('sessions_channel_id_fk', 'sessions_channel_id_fkey');
+
+  SELECT count(*)::integer
+  INTO exact_count
+  FROM pg_catalog.pg_constraint AS constraint_row
+  JOIN pg_catalog.pg_attribute AS local_column
+    ON local_column.attrelid = constraint_row.conrelid
+   AND local_column.attnum = constraint_row.conkey[1]
+  JOIN pg_catalog.pg_attribute AS referenced_column
+    ON referenced_column.attrelid = constraint_row.confrelid
+   AND referenced_column.attnum = constraint_row.confkey[1]
+  WHERE constraint_row.conrelid = 'sessions'::regclass
+    AND constraint_row.confrelid = 'channels'::regclass
+    AND constraint_row.contype = 'f'
+    AND constraint_row.conname IN ('sessions_channel_id_fk', 'sessions_channel_id_fkey')
+    AND cardinality(constraint_row.conkey) = 1
+    AND cardinality(constraint_row.confkey) = 1
+    AND local_column.attname = 'channel_id'
+    AND referenced_column.attname = 'id'
+    AND constraint_row.confdeltype = 'n'
+    AND constraint_row.confupdtype = 'a'
+    AND constraint_row.confmatchtype = 's'
+    AND NOT constraint_row.condeferrable
+    AND NOT constraint_row.condeferred;
+
+  IF same_name_count <> exact_count OR exact_count > 1 THEN
+    RAISE EXCEPTION
+      'sessions channel foreign key name is occupied by an incompatible constraint';
+  END IF;
+
+  IF exact_count = 0 THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_channel_id_fk"
+      FOREIGN KEY ("channel_id")
+      REFERENCES "channels"("id")
+      MATCH SIMPLE
+      ON UPDATE NO ACTION
+      ON DELETE SET NULL
+      NOT DEFERRABLE
+      NOT VALID;
+
+    SELECT count(*)::integer
+    INTO exact_count
+    FROM pg_catalog.pg_constraint AS constraint_row
+    JOIN pg_catalog.pg_attribute AS local_column
+      ON local_column.attrelid = constraint_row.conrelid
+     AND local_column.attnum = constraint_row.conkey[1]
+    JOIN pg_catalog.pg_attribute AS referenced_column
+      ON referenced_column.attrelid = constraint_row.confrelid
+     AND referenced_column.attnum = constraint_row.confkey[1]
+    WHERE constraint_row.conrelid = 'sessions'::regclass
+      AND constraint_row.confrelid = 'channels'::regclass
+      AND constraint_row.contype = 'f'
+      AND constraint_row.conname = 'sessions_channel_id_fk'
+      AND cardinality(constraint_row.conkey) = 1
+      AND cardinality(constraint_row.confkey) = 1
+      AND local_column.attname = 'channel_id'
+      AND referenced_column.attname = 'id'
+      AND constraint_row.confdeltype = 'n'
+      AND constraint_row.confupdtype = 'a'
+      AND constraint_row.confmatchtype = 's'
+      AND NOT constraint_row.condeferrable
+      AND NOT constraint_row.condeferred;
+
+    IF exact_count <> 1 THEN
+      RAISE EXCEPTION 'failed to install the exact sessions channel foreign key';
+    END IF;
+  END IF;
+END
+$migration$;

package/drizzle/0223_pending_tool_event_output.sql

@@ -0,0 +1,55 @@
+-- deployment-mode: rolling
+-- Preserve the exact audit-event output separately from the bounded
+-- model-facing result item so crash recovery can reproduce the live event.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE session_pending_tool_calls
+  ADD COLUMN IF NOT EXISTS event_output jsonb,
+  ADD COLUMN IF NOT EXISTS event_output_codec_version integer;
+
+ALTER TABLE session_pending_tool_calls
+  DROP CONSTRAINT IF EXISTS session_pending_tool_calls_event_output_codec_version_chk;
+
+ALTER TABLE session_pending_tool_calls
+  ADD CONSTRAINT session_pending_tool_calls_event_output_codec_version_chk
+  CHECK (
+    (event_output IS NULL AND event_output_codec_version IS NULL)
+    OR (event_output IS NOT NULL AND event_output_codec_version = 1)
+  ) NOT VALID;
+
+ALTER TABLE session_pending_tool_calls
+  VALIDATE CONSTRAINT session_pending_tool_calls_event_output_codec_version_chk;
+
+COMMENT ON COLUMN session_pending_tool_calls.event_output IS
+  'Lossless {value} envelope for the exact agent.toolCall.output projection retained until live publish or recovery.';
+COMMENT ON COLUMN session_pending_tool_calls.event_output_codec_version IS
+  'Out-of-band lossless JSON codec version for event_output; NULL denotes an older writer or no retained event output.';
+
+CREATE OR REPLACE FUNCTION opengeni_private.guard_pending_tool_event_output_delete()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+  IF OLD.event_output IS NOT NULL
+    AND nullif(current_setting('opengeni.account_id', true), '') IS NOT NULL
+    AND current_setting('opengeni.pending_tool_event_output_v1', true) IS DISTINCT FROM '1' THEN
+    RAISE EXCEPTION USING
+      ERRCODE = '55000',
+      MESSAGE = 'rich pending tool output requires a v1-aware settlement worker';
+  END IF;
+  RETURN OLD;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS session_pending_tool_calls_event_output_delete_guard
+  ON session_pending_tool_calls;
+
+CREATE TRIGGER session_pending_tool_calls_event_output_delete_guard
+BEFORE DELETE ON session_pending_tool_calls
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.guard_pending_tool_event_output_delete();
+
+REVOKE ALL ON FUNCTION opengeni_private.guard_pending_tool_event_output_delete() FROM PUBLIC;