@opengeni/db 0.7.3 → 0.10.7

package/drizzle/0068_workspace_control_event_bounds.sql

@@ -0,0 +1,134 @@
+-- deployment-mode: rolling
+-- tracking-64: workspace-control rows are compact invalidations, not evidence blobs.
+-- Preserve exact source byte counts while bounding the two free-form fields so
+-- old binaries and direct writers cannot create a durable replay poison row.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE workspace_control_events
+  ADD COLUMN reason_original_bytes integer,
+  ADD COLUMN actor_original_bytes integer;
+
+CREATE OR REPLACE FUNCTION opengeni_private.truncate_workspace_control_text(
+  source_text text,
+  max_bytes integer
+)
+RETURNS text
+LANGUAGE plpgsql
+IMMUTABLE
+STRICT
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  marker constant text := '…[truncated]';
+  prefix_budget integer := greatest(0, max_bytes - octet_length(marker));
+  candidate text;
+  excess integer;
+BEGIN
+  IF octet_length(source_text) <= max_bytes THEN
+    RETURN source_text;
+  END IF;
+
+  -- left() is character-safe. Starting at at most prefix_budget characters
+  -- caps allocation even for a multi-megabyte legacy value; each pass removes
+  -- enough characters for the worst-case four-byte UTF-8 encoding.
+  candidate := left(source_text, prefix_budget);
+  WHILE octet_length(candidate) > prefix_budget LOOP
+    excess := octet_length(candidate) - prefix_budget;
+    candidate := left(candidate, greatest(0, char_length(candidate) - ceil(excess / 4.0)::integer));
+  END LOOP;
+  RETURN candidate || marker;
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.bound_workspace_control_event()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  source_bytes integer;
+BEGIN
+  IF NEW.reason IS NULL THEN
+    NEW.reason_original_bytes := NULL;
+  ELSE
+    source_bytes := octet_length(NEW.reason);
+    IF TG_OP = 'INSERT' THEN
+      NEW.reason_original_bytes := greatest(source_bytes, coalesce(NEW.reason_original_bytes, 0));
+    ELSIF NEW.reason IS DISTINCT FROM OLD.reason THEN
+      -- An update from an old binary carries the old metadata column even
+      -- though it knows only `reason`. A genuinely changed raw value starts a
+      -- new byte fact instead of inheriting the previous value's larger count.
+      NEW.reason_original_bytes := source_bytes;
+    ELSE
+      NEW.reason_original_bytes := greatest(
+        source_bytes,
+        coalesce(NEW.reason_original_bytes, OLD.reason_original_bytes, 0)
+      );
+    END IF;
+    NEW.reason := opengeni_private.truncate_workspace_control_text(NEW.reason, 8192);
+  END IF;
+
+  source_bytes := octet_length(NEW.actor);
+  IF TG_OP = 'INSERT' THEN
+    NEW.actor_original_bytes := greatest(source_bytes, coalesce(NEW.actor_original_bytes, 0));
+  ELSIF NEW.actor IS DISTINCT FROM OLD.actor THEN
+    NEW.actor_original_bytes := source_bytes;
+  ELSE
+    NEW.actor_original_bytes := greatest(
+      source_bytes,
+      coalesce(NEW.actor_original_bytes, OLD.actor_original_bytes, 0)
+    );
+  END IF;
+  NEW.actor := opengeni_private.truncate_workspace_control_text(NEW.actor, 1024);
+  RETURN NEW;
+END;
+$function$;
+
+CREATE TRIGGER workspace_control_events_bound_fields
+BEFORE INSERT OR UPDATE OF reason, actor, reason_original_bytes, actor_original_bytes
+ON workspace_control_events
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.bound_workspace_control_event();
+
+-- Rewrite only historical rows that violate the new durable caps. Already
+-- bounded rows are safe to serve as-is and retain null metadata as the explicit
+-- rolling-upgrade legacy shape; avoiding a blanket UPDATE keeps installation
+-- work proportional to poison rows instead of table cardinality. The original
+-- counts are supplied in the same statement so truncation never erases truth.
+UPDATE workspace_control_events
+SET
+  reason_original_bytes = CASE WHEN reason IS NULL THEN NULL ELSE octet_length(reason) END,
+  actor_original_bytes = octet_length(actor),
+  reason = reason,
+  actor = actor
+WHERE octet_length(reason) > 8192
+   OR octet_length(actor) > 1024;
+
+ALTER TABLE workspace_control_events
+  ADD CONSTRAINT workspace_control_events_reason_bytes_check
+    CHECK (reason IS NULL OR octet_length(reason) <= 8192) NOT VALID,
+  ADD CONSTRAINT workspace_control_events_actor_bytes_check
+    CHECK (octet_length(actor) <= 1024) NOT VALID,
+  ADD CONSTRAINT workspace_control_events_original_bytes_check
+    CHECK (
+      (reason IS NULL AND reason_original_bytes IS NULL)
+      OR (
+        reason IS NOT NULL
+        AND (
+          reason_original_bytes IS NULL
+          OR reason_original_bytes >= octet_length(reason)
+        )
+      )
+    ) NOT VALID,
+  ADD CONSTRAINT workspace_control_events_actor_original_bytes_check
+    CHECK (
+      actor_original_bytes IS NULL
+      OR actor_original_bytes >= octet_length(actor)
+    ) NOT VALID;
+
+ALTER TABLE workspace_control_events
+  VALIDATE CONSTRAINT workspace_control_events_reason_bytes_check,
+  VALIDATE CONSTRAINT workspace_control_events_actor_bytes_check,
+  VALIDATE CONSTRAINT workspace_control_events_original_bytes_check,
+  VALIDATE CONSTRAINT workspace_control_events_actor_original_bytes_check;

package/drizzle/0069_session_event_history_backfill.sql

@@ -0,0 +1,32 @@
+-- deployment-mode: rolling
+-- tracking-64: finish the 0067 expand/contract sequence. The trigger has bounded
+-- every new/updated row since 0067; now rewrite only legacy violations through
+-- that trigger and validate the durable storage invariant.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+UPDATE session_events
+SET
+  payload = payload,
+  type = type,
+  client_event_id = client_event_id,
+  producer_id = producer_id,
+  turn_association = turn_association,
+  duplicate_reason = duplicate_reason
+WHERE octet_length(payload::text) > 65536
+  OR octet_length(type) > 256
+  OR position(E'\n' in type) > 0
+  OR position(E'\r' in type) > 0
+  OR (client_event_id IS NOT NULL AND octet_length(client_event_id) > 1024)
+  OR (producer_id IS NOT NULL AND octet_length(producer_id) > 1024)
+  OR (turn_association IS NOT NULL AND octet_length(turn_association) > 64)
+  OR (duplicate_reason IS NOT NULL AND octet_length(duplicate_reason) > 4096);
+
+ALTER TABLE session_events
+  VALIDATE CONSTRAINT session_events_payload_bytes_check,
+  VALIDATE CONSTRAINT session_events_type_bytes_check,
+  VALIDATE CONSTRAINT session_events_client_event_id_bytes_check,
+  VALIDATE CONSTRAINT session_events_producer_id_bytes_check,
+  VALIDATE CONSTRAINT session_events_turn_association_bytes_check,
+  VALIDATE CONSTRAINT session_events_duplicate_reason_bytes_check;

package/drizzle/0070_session_event_type_sequence_lookup.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "session_events_workspace_session_type_sequence_idx"
+  ON "session_events" ("workspace_id", "session_id", "type", "sequence" DESC);

package/drizzle/0071_session_event_monitoring_tail.sql

@@ -0,0 +1,10 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "session_events_workspace_session_monitoring_tail_idx"
+  ON "session_events" ("workspace_id", "session_id", "sequence" DESC)
+  WHERE "type" NOT IN (
+    'agent.message.delta',
+    'agent.reasoning.delta',
+    'sandbox.command.output.delta',
+    'terminal.pty.output.delta'
+  );

package/drizzle/0072_sessions_workspace_created_id_idx.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "sessions_workspace_created_id_idx"
+  ON "sessions" ("workspace_id", "created_at" DESC, "id" DESC);

package/drizzle/0073_sessions_workspace_updated_id_idx.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "sessions_workspace_updated_id_idx"
+  ON "sessions" ("workspace_id", "updated_at" DESC, "id" DESC);

package/drizzle/0074_session_activity_revisions.sql

@@ -0,0 +1,72 @@
+-- deployment-mode: rolling
+-- tracking-65: transactional workspace revisions make updated-order discovery and
+-- its next incremental scan one gap-free handoff independent of application
+-- clocks. Existing sessions remain revision zero until their next activity.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE TABLE "workspace_session_activity_revisions" (
+  "workspace_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "revision" bigint NOT NULL DEFAULT 0,
+  CONSTRAINT "workspace_session_activity_revisions_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "workspace_session_activity_revisions_revision_check"
+    CHECK ("revision" >= 0)
+);
+
+ALTER TABLE "workspace_session_activity_revisions" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "workspace_session_activity_revisions" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "workspace_session_activity_revisions"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- PostgreSQL installs this constant default without rewriting existing rows.
+-- Revision zero is an intentional legacy bucket ordered by (updated_at, id).
+ALTER TABLE "sessions"
+  ADD COLUMN "activity_revision" bigint NOT NULL DEFAULT 0;
+
+CREATE OR REPLACE FUNCTION opengeni_private.assign_session_activity_revision()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  next_revision bigint;
+BEGIN
+  EXECUTE format(
+    'INSERT INTO %I.workspace_session_activity_revisions AS counter '
+    || '(workspace_id, account_id, revision) VALUES ($1, $2, 1) '
+    || 'ON CONFLICT (workspace_id) DO UPDATE SET '
+    || 'account_id = excluded.account_id, revision = counter.revision + 1 '
+    || 'RETURNING revision',
+    TG_TABLE_SCHEMA
+  )
+  INTO next_revision
+  USING NEW.workspace_id, NEW.account_id;
+
+  NEW.activity_revision := next_revision;
+  RETURN NEW;
+END;
+$function$;
+
+CREATE TRIGGER sessions_assign_activity_revision
+BEFORE INSERT OR UPDATE OF updated_at, activity_revision
+ON "sessions"
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.assign_session_activity_revision();
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.workspace_session_activity_revisions TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END $grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0075_sessions_workspace_activity_revision_idx.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "sessions_workspace_activity_revision_idx"
+  ON "sessions" ("workspace_id", "activity_revision" DESC, "updated_at" DESC, "id" DESC);

package/drizzle/0076_session_workflow_wake_acl.sql

@@ -0,0 +1,13 @@
+-- deployment-mode: rolling
+-- Migration 0063 recreates this SECURITY DEFINER function and revokes its
+-- default PUBLIC authority. Restore only the runtime dispatcher's exact grant;
+-- production Helm runs migrations without a separate provision-roles pass.
+REVOKE ALL ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer) FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0077_session_attempt_latest_lookup.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "session_turn_attempts_latest_session_idx"
+  ON "session_turn_attempts" ("workspace_id", "session_id", "started_at" DESC, "id" DESC);

package/drizzle/0094_quarantine_credential_bearing_catalog_urls.sql

@@ -0,0 +1,51 @@
+-- deployment-mode: rolling
+-- Catalog endpoints are public data. Remove opaque query/fragment/userinfo/path URLs
+-- imported before the catalog hygiene gate and prevent their continued use.
+DELETE FROM "capability_installations" AS "installation"
+WHERE EXISTS (
+  SELECT 1
+  FROM "capability_catalog_items" AS "registry_item"
+  WHERE
+    "registry_item"."id" = "installation"."capability_id"
+    AND "registry_item"."workspace_id" IS NULL
+    AND "registry_item"."source" = 'registry'
+    AND "registry_item"."metadata" ->> 'registry' = 'integrations.sh'
+    AND (
+      "registry_item"."endpoint_url" LIKE '%?%'
+      OR "registry_item"."endpoint_url" LIKE '%#%'
+      OR "registry_item"."endpoint_url" ~* '^https?://[^/?#]*@'
+      OR "registry_item"."endpoint_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+      OR "registry_item"."mcp_url" LIKE '%?%'
+      OR "registry_item"."mcp_url" LIKE '%#%'
+      OR "registry_item"."mcp_url" ~* '^https?://[^/?#]*@'
+      OR "registry_item"."mcp_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+    )
+)
+AND NOT EXISTS (
+  SELECT 1
+  FROM "capability_catalog_items" AS "workspace_item"
+  WHERE
+    "workspace_item"."workspace_id" = "installation"."workspace_id"
+    AND "workspace_item"."id" = "installation"."capability_id"
+);
+
+DELETE FROM "capability_catalog_items"
+WHERE
+  "source" = 'registry'
+  AND "metadata" ->> 'registry' = 'integrations.sh'
+  AND (
+    "endpoint_url" LIKE '%?%'
+    OR "endpoint_url" LIKE '%#%'
+    OR "endpoint_url" ~* '^https?://[^/?#]*@'
+    OR "endpoint_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+    OR "mcp_url" LIKE '%?%'
+    OR "mcp_url" LIKE '%#%'
+    OR "mcp_url" ~* '^https?://[^/?#]*@'
+    OR "mcp_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+  );
+
+-- Earlier import diagnostics may contain the same URLs. Counts remain in their
+-- dedicated columns; the unstructured diagnostic payload is not authoritative.
+UPDATE "import_batches"
+SET "details" = '{}'::jsonb, "updated_at" = NOW()
+WHERE "source" = 'integrations.sh';

package/drizzle/0095_github_existing_installations.sql

@@ -0,0 +1,84 @@
+-- deployment-mode: rolling
+
+ALTER TABLE "github_installations"
+  ADD COLUMN IF NOT EXISTS "repository_scope" text NOT NULL DEFAULT 'all';
+ALTER TABLE "github_installations"
+  ADD COLUMN IF NOT EXISTS "linked_by_subject_id" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installations_repository_scope_check'
+      AND conrelid = 'github_installations'::regclass
+  ) THEN
+    ALTER TABLE "github_installations"
+      ADD CONSTRAINT "github_installations_repository_scope_check"
+      CHECK ("repository_scope" IN ('all', 'selected'));
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS "github_installation_repositories" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "installation_id" integer NOT NULL,
+  "repository_id" bigint NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installation_repositories_workspace_account_fk'
+      AND conrelid = 'github_installation_repositories'::regclass
+  ) THEN
+    ALTER TABLE "github_installation_repositories"
+      ADD CONSTRAINT "github_installation_repositories_workspace_account_fk"
+      FOREIGN KEY ("workspace_id", "account_id")
+      REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installation_repositories_installation_fk'
+      AND conrelid = 'github_installation_repositories'::regclass
+  ) THEN
+    ALTER TABLE "github_installation_repositories"
+      ADD CONSTRAINT "github_installation_repositories_installation_fk"
+      FOREIGN KEY ("workspace_id", "installation_id")
+      REFERENCES "github_installations"("workspace_id", "installation_id") ON DELETE CASCADE;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "github_install_repo_workspace_installation_repo_idx"
+  ON "github_installation_repositories" ("workspace_id", "installation_id", "repository_id");
+CREATE INDEX IF NOT EXISTS "github_install_repo_workspace_installation_idx"
+  ON "github_installation_repositories" ("workspace_id", "installation_id");
+
+ALTER TABLE "github_installation_repositories" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "github_installation_repositories" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'github_installation_repositories'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "github_installation_repositories";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "github_installation_repositories"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END $$;

package/drizzle/0096_session_turn_initiators.sql

@@ -0,0 +1,97 @@
+-- deployment-mode: rolling
+-- Existing rows and old rolling-deploy writers receive an explicit service
+-- sentinel. Host credential resolvers must reject that sentinel; it is never
+-- inferred back to a session creator.
+
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "created_by_kind" text NOT NULL DEFAULT 'service',
+  ADD COLUMN IF NOT EXISTS "created_by_subject_id" text NOT NULL DEFAULT 'unattributed-legacy',
+  ADD COLUMN IF NOT EXISTS "created_by_context" jsonb NOT NULL DEFAULT '{"backfill":true}'::jsonb;
+
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "initiator_kind" text NOT NULL DEFAULT 'service',
+  ADD COLUMN IF NOT EXISTS "initiator_subject_id" text NOT NULL DEFAULT 'unattributed-legacy',
+  ADD COLUMN IF NOT EXISTS "initiator_context" jsonb NOT NULL DEFAULT '{"backfill":true}'::jsonb;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'sessions_created_by_kind_check'
+      AND conrelid = 'sessions'::regclass
+  ) THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_created_by_kind_check"
+      CHECK ("created_by_kind" IN ('subject', 'service')) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'session_turns_initiator_kind_check'
+      AND conrelid = 'session_turns'::regclass
+  ) THEN
+    ALTER TABLE "session_turns"
+      ADD CONSTRAINT "session_turns_initiator_kind_check"
+      CHECK ("initiator_kind" IN ('subject', 'service')) NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "sessions" VALIDATE CONSTRAINT "sessions_created_by_kind_check";
+ALTER TABLE "session_turns" VALIDATE CONSTRAINT "session_turns_initiator_kind_check";
+
+CREATE OR REPLACE FUNCTION opengeni_private.prevent_session_creator_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.created_by_kind IS DISTINCT FROM OLD.created_by_kind
+    OR NEW.created_by_subject_id IS DISTINCT FROM OLD.created_by_subject_id
+    OR NEW.created_by_context IS DISTINCT FROM OLD.created_by_context
+  THEN
+    RAISE EXCEPTION 'session creator is immutable' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.prevent_session_turn_initiator_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.initiator_kind IS DISTINCT FROM OLD.initiator_kind
+    OR NEW.initiator_subject_id IS DISTINCT FROM OLD.initiator_subject_id
+    OR NEW.initiator_context IS DISTINCT FROM OLD.initiator_context
+  THEN
+    RAISE EXCEPTION 'session turn initiator is immutable' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger
+    WHERE tgname = 'sessions_creator_immutable'
+      AND tgrelid = 'sessions'::regclass
+      AND NOT tgisinternal
+  ) THEN
+    CREATE TRIGGER sessions_creator_immutable
+      BEFORE UPDATE OF created_by_kind, created_by_subject_id, created_by_context
+      ON "sessions"
+      FOR EACH ROW
+      EXECUTE FUNCTION opengeni_private.prevent_session_creator_mutation();
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger
+    WHERE tgname = 'session_turns_initiator_immutable'
+      AND tgrelid = 'session_turns'::regclass
+      AND NOT tgisinternal
+  ) THEN
+    CREATE TRIGGER session_turns_initiator_immutable
+      BEFORE UPDATE OF initiator_kind, initiator_subject_id, initiator_context
+      ON "session_turns"
+      FOR EACH ROW
+      EXECUTE FUNCTION opengeni_private.prevent_session_turn_initiator_mutation();
+  END IF;
+END $$;