@opengeni/db 0.6.1 → 0.7.1

package/drizzle/0058_turn_admission_usage_enrollment.sql

@@ -0,0 +1,158 @@
+-- One-way production remediation after the 0057 session-control cutover.
+--
+-- 1. Provider response usage has exactly one authoritative current event. SDK
+--    wrapper duplicates stay in the audit log with an explicit association.
+-- 2. Workflow repair enrolls every durable state that needs a session workflow,
+--    including approval/capacity waits and pending control settlement.
+
+ALTER TABLE "session_events"
+  DROP CONSTRAINT "session_events_turn_association_check";
+
+ALTER TABLE "session_events"
+  ADD COLUMN "duplicate_of_event_id" uuid,
+  ADD COLUMN "duplicate_reason" text;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_duplicate_of_event_fk"
+  FOREIGN KEY ("duplicate_of_event_id")
+  REFERENCES "session_events"("id") ON DELETE RESTRICT;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_turn_association_check"
+  CHECK (
+    "turn_association" IS NULL
+    OR "turn_association" IN ('current', 'late_rejected', 'duplicate')
+  );
+
+-- Keep the earliest event as the authoritative observation. Every later event
+-- for the same turn/provider-response source remains queryable and points to
+-- that canonical row; nothing is deleted or disguised as a late attempt write.
+WITH ranked AS (
+  SELECT
+    e."id",
+    first_value(e."id") OVER (
+      PARTITION BY
+        e."workspace_id",
+        e."session_id",
+        e."turn_id",
+        e."payload" ->> 'sourceKey'
+      ORDER BY e."sequence", e."id"
+    ) AS "canonical_id",
+    row_number() OVER (
+      PARTITION BY
+        e."workspace_id",
+        e."session_id",
+        e."turn_id",
+        e."payload" ->> 'sourceKey'
+      ORDER BY e."sequence", e."id"
+    ) AS "ordinal"
+  FROM "session_events" e
+  WHERE e."type" = 'agent.model.usage'
+    AND e."turn_association" = 'current'
+    AND e."turn_id" IS NOT NULL
+    AND nullif(e."payload" ->> 'sourceKey', '') IS NOT NULL
+)
+UPDATE "session_events" e
+SET "turn_association" = 'duplicate',
+    "duplicate_of_event_id" = ranked."canonical_id",
+    "duplicate_reason" = 'duplicate_provider_response_usage'
+FROM ranked
+WHERE e."id" = ranked."id"
+  AND ranked."ordinal" > 1;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_duplicate_classification_check"
+  CHECK (
+    (
+      "turn_association" = 'duplicate'
+      AND "type" = 'agent.model.usage'
+      AND "duplicate_of_event_id" IS NOT NULL
+      AND "duplicate_of_event_id" <> "id"
+      AND nullif("duplicate_reason", '') IS NOT NULL
+    )
+    OR (
+      "turn_association" IS DISTINCT FROM 'duplicate'
+      AND "duplicate_of_event_id" IS NULL
+      AND "duplicate_reason" IS NULL
+    )
+  );
+
+CREATE UNIQUE INDEX "session_events_current_model_usage_source_uq"
+  ON "session_events" (
+    "workspace_id",
+    "session_id",
+    "turn_id",
+    (("payload" ->> 'sourceKey'))
+  )
+  WHERE "type" = 'agent.model.usage'
+    AND "turn_association" = 'current'
+    AND "turn_id" IS NOT NULL
+    AND nullif("payload" ->> 'sourceKey', '') IS NOT NULL;
+
+-- The old name described database claimability, not the actual operational
+-- contract. A workflow must also be enrolled while it waits for approval or
+-- capacity, and any pending Pause/Steer control needs a workflow to settle it.
+DROP FUNCTION opengeni_private.list_claimable_sessions(integer);
+
+CREATE FUNCTION opengeni_private.list_enrollable_sessions(p_limit integer)
+RETURNS TABLE (
+  account_id uuid,
+  workspace_id uuid,
+  session_id uuid,
+  temporal_workflow_id text
+)
+LANGUAGE sql
+SECURITY DEFINER
+AS $$
+  SELECT DISTINCT
+    s.account_id,
+    s.workspace_id,
+    s.id,
+    coalesce(s.temporal_workflow_id, 'session-' || s.id::text)
+  FROM sessions s
+  JOIN workspaces w ON w.id = s.workspace_id
+  WHERE
+    -- Controls are durable intent. Even a closed inference gate must enroll a
+    -- workflow long enough to settle the pending Pause/Steer fence.
+    s.pending_control_event_id IS NOT NULL
+    OR (
+      s.control_state = 'active'
+      AND (
+        w.inference_state = 'active'
+        OR s.workspace_run_exception_generation = w.inference_generation
+      )
+      AND (
+        EXISTS (
+          SELECT 1 FROM session_turns t
+          WHERE t.workspace_id = s.workspace_id
+            AND t.session_id = s.id
+            AND t.status IN ('queued', 'recovering', 'waiting_capacity', 'requires_action')
+        )
+        OR EXISTS (
+          SELECT 1 FROM session_system_updates u
+          WHERE u.workspace_id = s.workspace_id
+            AND u.session_id = s.id
+            AND u.state = 'pending'
+        )
+        OR EXISTS (
+          SELECT 1 FROM session_goals g
+          WHERE g.workspace_id = s.workspace_id
+            AND g.session_id = s.id
+            AND g.status = 'active'
+        )
+      )
+    )
+  ORDER BY s.id
+  LIMIT greatest(1, least(coalesce(p_limit, 1000), 10000));
+$$;
+
+REVOKE ALL ON FUNCTION opengeni_private.list_enrollable_sessions(integer) FROM PUBLIC;
+
+DO $$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.list_enrollable_sessions(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0059_workspace_pause_control_kind.sql

@@ -0,0 +1,12 @@
+-- Workspace Pause is a first-class durable control kind. The 0057 constraint
+-- predates that control path and must match the canonical runtime state machine.
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT "sessions_pending_control_kind_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_pending_control_kind_check"
+  CHECK (
+    "pending_control_kind" IS NULL
+    OR "pending_control_kind" IN ('pause', 'workspace_pause', 'steer')
+  );

package/drizzle/0060_session_system_update_deferral.sql

@@ -0,0 +1,10 @@
+-- A failed internal-only inference preserves ordinary internal updates without
+-- making them independently runnable again. They become eligible when a real
+-- prompt or a genuinely new pending internal update starts the next inference.
+
+ALTER TABLE "session_system_updates"
+  DROP CONSTRAINT "system_updates_state_check";
+
+ALTER TABLE "session_system_updates"
+  ADD CONSTRAINT "system_updates_state_check"
+  CHECK ("state" IN ('pending', 'deferred', 'delivered', 'cancelled', 'failed'));

package/drizzle/0061_session_workflow_wake_outbox.sql

@@ -0,0 +1,157 @@
+-- OPE-50: replace the blind periodic scan of "enrollable" sessions with a
+-- transactional, revisioned, coalescing delivery ledger. Postgres is the
+-- durable work source; a Temporal signal is an idempotent nudge.
+
+CREATE TABLE "session_workflow_wake_outbox" (
+  "session_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "temporal_workflow_id" text NOT NULL,
+  "wake_revision" bigint NOT NULL DEFAULT 1,
+  "delivered_revision" bigint NOT NULL DEFAULT 0,
+  "reason" text NOT NULL,
+  "attempts" integer NOT NULL DEFAULT 0,
+  "next_attempt_at" timestamptz NOT NULL DEFAULT now(),
+  "last_error" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_workflow_wake_outbox_revision_check"
+    CHECK ("wake_revision" > 0 AND "delivered_revision" >= 0
+      AND "delivered_revision" <= "wake_revision"),
+  CONSTRAINT "session_workflow_wake_outbox_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "session_workflow_wake_outbox_workspace_session_fk"
+    FOREIGN KEY ("workspace_id", "session_id")
+    REFERENCES "sessions"("workspace_id", "id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "session_workflow_wake_outbox_workspace_session_uq"
+  ON "session_workflow_wake_outbox" ("workspace_id", "session_id");
+CREATE INDEX "session_workflow_wake_outbox_pending_idx"
+  ON "session_workflow_wake_outbox" ("next_attempt_at", "updated_at", "session_id")
+  WHERE "wake_revision" > "delivered_revision";
+
+ALTER TABLE "session_workflow_wake_outbox" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_workflow_wake_outbox" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "session_workflow_wake_outbox"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Workspace control retries now persist the exact control deliveries they own.
+-- Canonicalize pre-cutover receipts once so runtime code has one result shape;
+-- any still-pending historical control is independently seeded below.
+UPDATE "runtime_control_operations"
+SET "result" = jsonb_set("result", '{controls}', '[]'::jsonb, true)
+WHERE "scope" = 'workspace'
+  AND jsonb_typeof("result") = 'object'
+  AND NOT ("result" ? 'controls');
+
+-- Claim only committed revisions that still need delivery. The due timestamp
+-- is advanced before delivery, so a process death becomes retryable after the
+-- bounded backoff. Acknowledgements are revision-scoped: an old delivery can
+-- never hide a newer committed wake.
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.claim_session_workflow_wakes(p_limit integer)
+    RETURNS TABLE (
+      account_id uuid,
+      workspace_id uuid,
+      session_id uuid,
+      temporal_workflow_id text,
+      wake_revision bigint,
+      control_event_id uuid
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      RETURN QUERY
+        WITH due AS (
+          SELECT o.session_id
+          FROM %1$I.session_workflow_wake_outbox o
+          WHERE o.wake_revision > o.delivered_revision
+            AND o.next_attempt_at <= now()
+          ORDER BY o.next_attempt_at, o.updated_at, o.session_id
+          FOR UPDATE SKIP LOCKED
+          LIMIT greatest(1, least(coalesce(p_limit, 100), 1000))
+        )
+        UPDATE %1$I.session_workflow_wake_outbox o
+        SET attempts = o.attempts + 1,
+            next_attempt_at = now() + make_interval(
+              secs => least(300, greatest(1, power(2, least(o.attempts, 8))::integer))
+            ),
+            updated_at = now()
+        FROM due
+        WHERE o.session_id = due.session_id
+        RETURNING o.account_id, o.workspace_id, o.session_id,
+          o.temporal_workflow_id, o.wake_revision,
+          (SELECT s.pending_control_event_id FROM %1$I.sessions s WHERE s.id = o.session_id)
+            AS control_event_id;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+REVOKE ALL ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer) FROM PUBLIC;
+
+-- One-time cutover seed. This is intentionally the final use of an eligibility
+-- scan: it converts already-committed pre-outbox work into explicit revisions.
+-- Runtime repair after this migration reads only the outbox.
+INSERT INTO "session_workflow_wake_outbox" (
+  "session_id", "account_id", "workspace_id", "temporal_workflow_id", "reason"
+)
+SELECT DISTINCT
+  s."id",
+  s."account_id",
+  s."workspace_id",
+  coalesce(s."temporal_workflow_id", 'session-' || s."id"::text),
+  'cutover_seed'
+FROM "sessions" s
+JOIN "workspaces" w ON w."id" = s."workspace_id"
+WHERE
+  s."pending_control_event_id" IS NOT NULL
+  OR (
+    s."control_state" = 'active'
+    AND (
+      w."inference_state" = 'active'
+      OR s."workspace_run_exception_generation" = w."inference_generation"
+    )
+    AND (
+      EXISTS (
+        SELECT 1 FROM "session_turns" t
+        WHERE t."workspace_id" = s."workspace_id"
+          AND t."session_id" = s."id"
+          AND t."status" IN ('queued', 'recovering', 'waiting_capacity', 'requires_action')
+      )
+      OR EXISTS (
+        SELECT 1 FROM "session_system_updates" u
+        WHERE u."workspace_id" = s."workspace_id"
+          AND u."session_id" = s."id"
+          AND u."state" = 'pending'
+      )
+      OR EXISTS (
+        SELECT 1 FROM "session_goals" g
+        WHERE g."workspace_id" = s."workspace_id"
+          AND g."session_id" = s."id"
+          AND g."status" = 'active'
+      )
+      OR s."compact_requested" = true
+    )
+  );
+
+DROP FUNCTION opengeni_private.list_enrollable_sessions(integer);
+
+DO $$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.session_workflow_wake_outbox TO opengeni_app',
+      target_schema
+    );
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0062_session_list_snapshot_reaper.sql

@@ -0,0 +1,48 @@
+-- OPE-44: session list reads are serializable and subject-scoped. Performing a
+-- global expired-row delete inside every read makes concurrent API replicas
+-- conflict on the same rows. Move TTL cleanup to one bounded SKIP LOCKED
+-- reaper operation and keep the request transaction strictly request-local.
+
+CREATE INDEX "session_list_snapshots_expiry_reaper_idx"
+  ON "session_list_snapshots" ("expires_at", "id");
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.reap_expired_session_list_snapshots(p_limit integer)
+    RETURNS integer
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE deleted_count integer;
+    BEGIN
+      WITH victims AS (
+        SELECT s.id
+        FROM %1$I.session_list_snapshots s
+        WHERE s.expires_at < now()
+        ORDER BY s.expires_at, s.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT greatest(1, least(coalesce(p_limit, 500), 5000))
+      ), deleted AS (
+        DELETE FROM %1$I.session_list_snapshots s
+        USING victims
+        WHERE s.id = victims.id
+        RETURNING s.id
+      )
+      SELECT count(*)::integer INTO deleted_count FROM deleted;
+      RETURN deleted_count;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.reap_expired_session_list_snapshots(integer) FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.reap_expired_session_list_snapshots(integer)
+      TO opengeni_app;
+  END IF;
+END $$;