@opengeni/db 1.0.1 → 3.1.0-canary.0

package/drizzle/0325_child_lifecycle_notices.sql

@@ -0,0 +1,44 @@
+-- deployment-mode: rolling
+-- Child lifecycle notices. A child session's requires_action freeze, its
+-- resolution, a direct Pause, a provider-capacity wait, and an agent goal
+-- progress note become typed `session_system_updates` rows for the parent, in
+-- addition to the existing `child_terminal_result`. Every one of them is
+-- produced through `session_system_update_outbox` by the child's own lifecycle
+-- transaction and delivered to the parent by the worker.
+--
+-- Rolling: this only widens the accepted kind sets and adds one partial index.
+-- No row is rewritten. A worker from before this change throws when it maps an
+-- unknown kind, so the producers stay behind
+-- OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED (default off) until the whole fleet
+-- runs an image that understands the new kinds.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "session_system_updates" DROP CONSTRAINT "system_updates_kind_check";
+ALTER TABLE "session_system_updates" ADD CONSTRAINT "system_updates_kind_check" CHECK (
+  "kind" IN (
+    'scheduled_occurrence', 'goal_continuation', 'agent_message',
+    'agent_steer_instruction', 'child_terminal_result', 'media_generation_result',
+    'child_requires_action', 'child_requires_action_resolved', 'child_paused',
+    'child_waiting_capacity', 'child_progress'
+  )
+);
+
+ALTER TABLE "session_system_update_outbox" DROP CONSTRAINT "system_update_outbox_kind_check";
+ALTER TABLE "session_system_update_outbox" ADD CONSTRAINT "system_update_outbox_kind_check" CHECK (
+  "kind" IN (
+    'child_terminal_result', 'child_requires_action', 'child_requires_action_resolved',
+    'child_paused', 'child_waiting_capacity', 'child_progress'
+  )
+);
+
+ALTER TABLE "session_system_update_outbox" DROP CONSTRAINT "system_update_outbox_payload_kind_check";
+ALTER TABLE "session_system_update_outbox" ADD CONSTRAINT "system_update_outbox_payload_kind_check" CHECK (
+  "payload" ->> 'type' = "kind"
+);
+
+-- Producer-side supersession and resolution lookups address one child's still
+-- pending notices of one kind on the parent: (parent session, kind, child id).
+CREATE INDEX IF NOT EXISTS "session_system_updates_pending_kind_source_idx"
+  ON "session_system_updates" ("workspace_id", "session_id", "kind", "source_id")
+  WHERE "state" = 'pending';

package/drizzle/0326_interaction_operation_error_codes.sql

@@ -0,0 +1,62 @@
+-- deployment-mode: maintenance
+-- Interaction operation receipts use the public controller-error enum. The
+-- durable resource keeps the exact internal loss reason; an ambiguous physical
+-- operation must expose the canonical `outcome_unknown` code so idempotent
+-- lifecycle replay remains parseable.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+-- `interaction_operations` is FORCE-RLS. Production migrations run as its
+-- NOSUPERUSER/NOBYPASSRLS owner without tenant GUCs, so the repair would
+-- otherwise see zero rows. This maintenance migration is one transaction;
+-- any failure rolls the temporary owner-only posture change back as well.
+ALTER TABLE "interaction_operations" NO FORCE ROW LEVEL SECURITY;
+
+DO $interaction_error_code_repair$
+DECLARE
+  data_schema text := current_schema();
+  reaper_definition text;
+  repaired_definition text;
+  repaired_rows integer := 0;
+BEGIN
+  SELECT pg_catalog.pg_get_functiondef(proc.oid)
+  INTO reaper_definition
+  FROM pg_catalog.pg_proc proc
+  JOIN pg_catalog.pg_namespace namespace ON namespace.oid = proc.pronamespace
+  WHERE namespace.nspname = 'opengeni_private'
+    AND proc.proname = 'reap_stale_interaction_transitions'
+    AND pg_catalog.pg_get_function_identity_arguments(proc.oid) = 'p_interaction_holder_ttl_ms bigint';
+
+  IF reaper_definition IS NULL THEN
+    RAISE EXCEPTION 'interaction transition reaper is missing';
+  END IF;
+
+  repaired_definition := pg_catalog.replace(
+    reaper_definition,
+    'error_code = ''controller_transition_expired''',
+    'error_code = ''outcome_unknown'''
+  );
+  IF repaired_definition = reaper_definition THEN
+    IF pg_catalog.strpos(reaper_definition, 'error_code = ''outcome_unknown''') = 0 THEN
+      RAISE EXCEPTION 'interaction transition reaper error-code contract is unrecognized';
+    END IF;
+  ELSE
+    EXECUTE repaired_definition;
+  END IF;
+
+  EXECUTE format($repair$
+    UPDATE %1$I.interaction_operations operation
+    SET error_code = 'outcome_unknown'
+    WHERE operation.state = 'outcome_unknown'
+      AND operation.error_code = 'controller_transition_expired'
+  $repair$, data_schema);
+  GET DIAGNOSTICS repaired_rows = ROW_COUNT;
+
+  RAISE NOTICE 'Repaired % interaction operation error-code receipt(s).', repaired_rows;
+END
+$interaction_error_code_repair$;
+
+ALTER TABLE "interaction_operations" FORCE ROW LEVEL SECURITY;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0327_slack_first_task_hint.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: rolling
+-- Slack first-task onboarding hint. The bot's acknowledgement used to repeat
+-- the same how-to prose on every accepted task. The prose now appears exactly
+-- once per Slack identity per installation, and this column is the durable
+-- claim that makes "exactly once" survive retries, replicas, and restarts.
+--
+-- The claimed value is the exact `slack_interactions` id that won the hint, not
+-- a boolean, so a replayed acknowledgement for that same interaction keeps
+-- rendering the hint while every later interaction never does.
+--
+-- Rolling: two nullable columns, no defaults, no backfill. Existing rows are
+-- untouched (NULL means "not shown yet" / "not resolved yet"), so an old image
+-- that never reads or writes either column keeps working, and the FORCE-RLS
+-- posture of `slack_bot_user_links` and `slack_interactions` is unchanged.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "slack_bot_user_links"
+  ADD COLUMN "first_task_hint_interaction_id" uuid;
+
+-- The rendered decision is frozen on the interaction itself, not recomputed per
+-- delivery. `slack_bot_post_operations` binds one operation id to one request
+-- digest that includes the message text, so an acknowledgement replayed after a
+-- crash, a lost provider response, or a replica race must re-render byte for
+-- byte. NULL means "not resolved yet"; once written the value never changes, so
+-- rendering is a pure function of durable state even if the identity is later
+-- unlinked and relinked.
+ALTER TABLE "slack_interactions"
+  ADD COLUMN "first_task_hint" boolean;