@opengeni/db 3.7.4 → 3.8.2-canary.0

package/drizzle/0391_sandbox_provider_deadline_interaction_followup.sql

@@ -0,0 +1,295 @@
+-- deployment-mode: rolling
+-- Repair the post-0388 provider-deadline interaction lifecycle without
+-- widening ordinary interaction expiry or weakening the session-tenancy fence.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+-- The TTL-aware fence inventory below must discover due lease-free controller
+-- transitions before the SECURITY DEFINER reaper opens its fenced owner scope.
+-- Keep this as inventory-only SELECT authority; the 0388 fenced owner policies
+-- remain the sole mutation path after every workspace advisory lock is held.
+DO $interaction_reaper_inventory_policies$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+  target_schema_oid oid := pg_catalog.current_schema()::pg_catalog.regnamespace;
+  migration_owner text := current_user;
+  table_name text;
+BEGIN
+  FOREACH table_name IN ARRAY ARRAY[
+    'browser_sessions',
+    'computer_sessions',
+    'interaction_operations'
+  ] LOOP
+    EXECUTE pg_catalog.format(
+      'DROP POLICY IF EXISTS session_tenancy_fence_inventory_read ON %I.%I',
+      target_schema,
+      table_name
+    );
+    EXECUTE pg_catalog.format(
+      'CREATE POLICY session_tenancy_fence_inventory_read ON %I.%I '
+        || 'FOR SELECT USING ('
+        || '%I.session_tenancy_fence_owner_policy_active('
+        || 'current_user::text, %L::text, %s::oid, workspace_id, true))',
+      target_schema,
+      table_name,
+      target_schema,
+      migration_owner,
+      target_schema_oid
+    );
+  END LOOP;
+END
+$interaction_reaper_inventory_policies$;
+
+-- The no-argument helper remains installed for reap_sandbox_leases() and old
+-- in-flight callers. The interaction reaper uses this overload so its bounded
+-- stale-operation batch can also see lease-free Connected Machine and attached-
+-- device workspaces. Because SKIP LOCKED can advance beyond any preselected
+-- operation row, fence every currently due workspace, but no healthy lease-free
+-- interaction workspace, in canonical UUID order before taking row locks.
+CREATE OR REPLACE FUNCTION acquire_sandbox_reaper_session_tenancy_fences(
+  p_interaction_holder_ttl_ms bigint
+)
+RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $interaction_reaper_fences$
+DECLARE
+  inventory_capability_id uuid;
+  workspace_id_value uuid;
+  locked_count integer := 0;
+BEGIN
+  IF p_interaction_holder_ttl_ms <= 0 THEN
+    RETURN 0;
+  END IF;
+  PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+  inventory_capability_id :=
+    opengeni_private.open_session_tenancy_fence_inventory(
+      session_tenancy_fence_target_schema()
+    );
+  FOR workspace_id_value IN
+    SELECT candidate.workspace_id
+    FROM (
+      SELECT lease.workspace_id
+      FROM sandbox_leases lease
+      WHERE lease.workspace_id IS NOT NULL
+        AND (
+          lease.liveness <> 'cold'
+          OR EXISTS (
+            SELECT 1
+            FROM sandbox_lease_holders holder
+            WHERE holder.lease_id = lease.id
+          )
+        )
+      UNION
+      SELECT operation.workspace_id
+      FROM interaction_operations operation
+      WHERE operation.workspace_id IS NOT NULL
+        -- Lease-free prepared operations remain replayable. A dispatched
+        -- operation is the first controller-side effect and is the only
+        -- lease-free transition the ordinary stale-transition reaper settles.
+        AND operation.state = 'dispatched'
+        AND operation.updated_at
+          < pg_catalog.now()
+            - pg_catalog.make_interval(
+                secs => p_interaction_holder_ttl_ms / 1000.0
+              )
+        AND (
+          EXISTS (
+            SELECT 1
+            FROM browser_sessions browser
+            WHERE operation.resource_kind = 'browser_session'
+              AND operation.account_id = browser.account_id
+              AND operation.workspace_id = browser.workspace_id
+              AND operation.resource_id = browser.id
+              AND browser.lifecycle IN (
+                'starting', 'suspending', 'restoring', 'ending'
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM computer_sessions computer
+            WHERE operation.resource_kind = 'computer_session'
+              AND operation.account_id = computer.account_id
+              AND operation.workspace_id = computer.workspace_id
+              AND operation.resource_id = computer.id
+              AND computer.lifecycle IN ('starting', 'ending')
+          )
+        )
+    ) candidate
+    ORDER BY candidate.workspace_id
+  LOOP
+    PERFORM acquire_session_tenancy_fence(workspace_id_value);
+    locked_count := locked_count + 1;
+  END LOOP;
+  PERFORM opengeni_private.close_session_tenancy_fence_inventory(
+    inventory_capability_id
+  );
+  RETURN locked_count;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM opengeni_private.close_session_tenancy_fence_inventory(
+    inventory_capability_id
+  );
+  RAISE;
+END
+$interaction_reaper_fences$;
+
+REVOKE ALL ON FUNCTION
+  acquire_sandbox_reaper_session_tenancy_fences(bigint)
+  FROM PUBLIC;
+
+-- CREATE OR REPLACE records `SET search_path FROM CURRENT` from the migrator
+-- connection. Re-pin this overload to the exact target schema before callers
+-- can invoke the enclosing reaper, so a caller-created temp relation cannot
+-- shadow its lease-free inventory before workspace fences are acquired.
+DO $pin_interaction_reaper_fence_helper$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.acquire_sandbox_reaper_session_tenancy_fences(bigint) '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+END
+$pin_interaction_reaper_fence_helper$;
+
+-- Patch only the exact 0388 definition. The interaction reaper keeps the
+-- canonical advisory-fence -> owner capability -> operation -> lease -> holder
+-- ordering. The holder EXISTS is an unlocked eligibility read before LIMIT;
+-- lease rows are still the first ownership rows locked by the deadline phase.
+DO $provider_deadline_interaction_followup$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  definition text;
+  patched text;
+  fence_anchor constant text :=
+    E'      PERFORM acquire_sandbox_reaper_session_tenancy_fences();';
+  fence_replacement constant text :=
+    E'      -- 0391 provider-deadline interaction follow-up: inventory due\n'
+    || E'      -- lease-free transitions before any interaction row lock.\n'
+    || E'      PERFORM acquire_sandbox_reaper_session_tenancy_fences(\n'
+    || E'        p_interaction_holder_ttl_ms\n'
+    || E'      );';
+  liveness_anchor constant text :=
+    E'          AND lease.liveness IN (''warming'', ''warm'')';
+  liveness_replacement constant text :=
+    E'          AND lease.liveness IN (''warming'', ''warm'', ''draining'')';
+  deadline_anchor constant text :=
+    E'          AND lease.provider_deadline_at <= pg_catalog.now()';
+  deadline_replacement text;
+  occurrences integer;
+BEGIN
+  SELECT pg_catalog.pg_get_functiondef(
+    'opengeni_private.reap_stale_interaction_transitions(bigint)'::regprocedure
+  ) INTO definition;
+
+  IF definition IS NULL
+    OR pg_catalog.strpos(definition, 'deadline_lease_ids uuid[]') = 0
+    OR pg_catalog.strpos(definition, 'provider_deadline_rotation') = 0
+    OR pg_catalog.strpos(definition, 'open_session_tenancy_fenced_access') = 0
+    OR pg_catalog.strpos(definition, 'LIMIT 500') = 0
+  THEN
+    RAISE EXCEPTION '0391 interaction reaper prerequisite definition drift'
+      USING ERRCODE = '55000';
+  END IF;
+
+  IF pg_catalog.strpos(
+    definition,
+    '0391 provider-deadline interaction follow-up'
+  ) > 0 THEN
+    IF pg_catalog.strpos(
+      definition,
+      'acquire_sandbox_reaper_session_tenancy_fences('
+    ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'p_interaction_holder_ttl_ms'
+      ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'lease.liveness IN (''warming'', ''warm'', ''draining'')'
+      ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'interaction_holder.kind = ''interaction'''
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0391 interaction reaper replay definition drift'
+        USING ERRCODE = '55000';
+    END IF;
+  ELSE
+    patched := definition;
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, fence_anchor, ''))
+    ) / pg_catalog.length(fence_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper fence anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(patched, fence_anchor, fence_replacement);
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, liveness_anchor, ''))
+    ) / pg_catalog.length(liveness_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper liveness anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      liveness_anchor,
+      liveness_replacement
+    );
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, deadline_anchor, ''))
+    ) / pg_catalog.length(deadline_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper deadline anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    deadline_replacement := deadline_anchor || pg_catalog.format(
+      E'\n          AND EXISTS (\n'
+        || E'            SELECT 1\n'
+        || E'            FROM %I.sandbox_lease_holders interaction_holder\n'
+        || E'            WHERE interaction_holder.lease_id = lease.id\n'
+        || E'              AND interaction_holder.kind = ''interaction''\n'
+        || E'          )',
+      data_schema
+    );
+    patched := pg_catalog.replace(
+      patched,
+      deadline_anchor,
+      deadline_replacement
+    );
+
+    IF pg_catalog.strpos(
+      patched,
+      '0391 provider-deadline interaction follow-up'
+    ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'lease.liveness IN (''warming'', ''warm'', ''draining'')'
+      ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'interaction_holder.kind = ''interaction'''
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0391 interaction reaper patch failed'
+        USING ERRCODE = '55000';
+    END IF;
+
+    EXECUTE patched;
+  END IF;
+END
+$provider_deadline_interaction_followup$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0392_context_compaction_pending_observability.sql

@@ -0,0 +1,198 @@
+-- deployment-mode: rolling
+-- Project exact-attempt automatic compaction starts into one content-free,
+-- restart-safe aggregate. Prometheus labels must never carry tenant/session ids,
+-- while process-local start/completion timestamps cannot correlate concurrent
+-- activities or survive the worker whose provider call became stuck.
+
+CREATE TABLE opengeni_private.context_compaction_pending_observations (
+  workspace_id uuid NOT NULL,
+  attempt_id uuid NOT NULL,
+  started_at timestamp with time zone NOT NULL,
+  PRIMARY KEY (workspace_id, attempt_id),
+  CONSTRAINT context_compaction_pending_observations_attempt_fk
+    FOREIGN KEY (workspace_id, attempt_id)
+    REFERENCES session_turn_attempts (workspace_id, id)
+    ON DELETE CASCADE
+);
+
+REVOKE ALL ON TABLE opengeni_private.context_compaction_pending_observations FROM PUBLIC;
+
+CREATE OR REPLACE FUNCTION opengeni_private.project_context_compaction_event()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $project_context_compaction_event$
+BEGIN
+  IF NEW.turn_attempt_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.type = 'session.context.compaction.started'
+    AND NEW.payload ->> 'trigger' = 'auto'
+  THEN
+    INSERT INTO opengeni_private.context_compaction_pending_observations (
+      workspace_id,
+      attempt_id,
+      started_at
+    ) VALUES (
+      NEW.workspace_id,
+      NEW.turn_attempt_id,
+      NEW.occurred_at
+    )
+    ON CONFLICT (workspace_id, attempt_id) DO UPDATE
+      SET started_at = EXCLUDED.started_at;
+  ELSIF NEW.type IN (
+    'session.context.compacted',
+    'session.context.compaction.skipped'
+  ) THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = NEW.turn_attempt_id;
+  END IF;
+
+  RETURN NEW;
+END
+$project_context_compaction_event$;
+
+REVOKE ALL ON FUNCTION opengeni_private.project_context_compaction_event() FROM PUBLIC;
+
+CREATE TRIGGER session_events_project_context_compaction_pending
+AFTER INSERT ON session_events
+FOR EACH ROW
+WHEN (
+  NEW.type IN (
+    'session.context.compaction.started',
+    'session.context.compacted',
+    'session.context.compaction.skipped'
+  )
+)
+EXECUTE FUNCTION opengeni_private.project_context_compaction_event();
+
+CREATE OR REPLACE FUNCTION opengeni_private.clear_context_compaction_pending_attempt()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $clear_context_compaction_pending_attempt$
+BEGIN
+  IF OLD.state <> 'closed' AND NEW.state = 'closed' THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = NEW.id;
+  END IF;
+  RETURN NEW;
+END
+$clear_context_compaction_pending_attempt$;
+
+REVOKE ALL ON FUNCTION opengeni_private.clear_context_compaction_pending_attempt() FROM PUBLIC;
+
+CREATE TRIGGER session_turn_attempts_clear_context_compaction_pending
+AFTER UPDATE OF state ON session_turn_attempts
+FOR EACH ROW
+WHEN (OLD.state IS DISTINCT FROM NEW.state)
+EXECUTE FUNCTION opengeni_private.clear_context_compaction_pending_attempt();
+
+CREATE OR REPLACE FUNCTION opengeni_private.clear_context_compaction_pending_turn()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $clear_context_compaction_pending_turn$
+BEGIN
+  IF OLD.active_attempt_id IS NOT NULL
+    AND OLD.active_attempt_id IS DISTINCT FROM NEW.active_attempt_id
+  THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = OLD.active_attempt_id;
+  END IF;
+  RETURN NEW;
+END
+$clear_context_compaction_pending_turn$;
+
+REVOKE ALL ON FUNCTION opengeni_private.clear_context_compaction_pending_turn() FROM PUBLIC;
+
+CREATE TRIGGER session_turns_clear_context_compaction_pending
+AFTER UPDATE OF active_attempt_id ON session_turns
+FOR EACH ROW
+WHEN (OLD.active_attempt_id IS DISTINCT FROM NEW.active_attempt_id)
+EXECUTE FUNCTION opengeni_private.clear_context_compaction_pending_turn();
+
+-- The migration owner is bound by FORCE RLS in production. Open the standard
+-- owner-only posture window while reconstructing any automatic provider call
+-- already in flight when this rolling migration lands.
+ALTER TABLE session_events NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turn_attempts NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turns NO FORCE ROW LEVEL SECURITY;
+
+WITH latest_landmark AS (
+  SELECT DISTINCT ON (event.workspace_id, event.turn_attempt_id)
+    event.workspace_id,
+    event.turn_attempt_id,
+    event.type,
+    event.payload,
+    event.occurred_at
+  FROM session_events event
+  WHERE event.turn_attempt_id IS NOT NULL
+    AND event.type IN (
+      'session.context.compaction.started',
+      'session.context.compacted',
+      'session.context.compaction.skipped'
+    )
+  ORDER BY
+    event.workspace_id,
+    event.turn_attempt_id,
+    event.sequence DESC,
+    event.id DESC
+)
+INSERT INTO opengeni_private.context_compaction_pending_observations (
+  workspace_id,
+  attempt_id,
+  started_at
+)
+SELECT
+  landmark.workspace_id,
+  landmark.turn_attempt_id,
+  landmark.occurred_at
+FROM latest_landmark landmark
+JOIN session_turn_attempts attempt
+  ON attempt.workspace_id = landmark.workspace_id
+ AND attempt.id = landmark.turn_attempt_id
+JOIN session_turns turn
+  ON turn.workspace_id = attempt.workspace_id
+ AND turn.id = attempt.turn_id
+ AND turn.active_attempt_id = attempt.id
+WHERE landmark.type = 'session.context.compaction.started'
+  AND landmark.payload ->> 'trigger' = 'auto'
+  AND attempt.state IN ('claimed', 'running')
+ON CONFLICT (workspace_id, attempt_id) DO UPDATE
+  SET started_at = EXCLUDED.started_at;
+
+ALTER TABLE session_turns FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turn_attempts FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events FORCE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION opengeni_private.context_compaction_pending_summary()
+RETURNS TABLE (pending_count bigint, oldest_started_at timestamp with time zone)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $context_compaction_pending_summary$
+  SELECT
+    count(*)::bigint AS pending_count,
+    min(pending.started_at) AS oldest_started_at
+  FROM opengeni_private.context_compaction_pending_observations pending
+$context_compaction_pending_summary$;
+
+REVOKE ALL ON FUNCTION opengeni_private.context_compaction_pending_summary() FROM PUBLIC;
+
+DO $context_compaction_observability_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.context_compaction_pending_summary()
+      TO opengeni_app;
+  END IF;
+END
+$context_compaction_observability_grants$;

package/drizzle/0393_workspace_memory_and_learning_defaults.sql

@@ -0,0 +1,102 @@
+-- deployment-mode: rolling
+-- Migration 0393: enable Workspace Memory by default and make approval-required
+-- workspace instruction/Skill learning the default when no policy revision has
+-- been activated.
+--
+-- Explicit memory opt-outs and activated learning-policy revisions remain
+-- authoritative. Existing immutable turn and learning snapshots are untouched.
+-- Materializing the Memory default in workspace settings keeps old and new
+-- rolling binaries aligned while the application resolver changes omission to
+-- enabled.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "workspaces"
+  ALTER COLUMN "settings" SET DEFAULT '{"memoryEnabled": true}'::jsonb;
+
+UPDATE "workspaces"
+SET "settings" = jsonb_set("settings", '{memoryEnabled}', 'true'::jsonb, true)
+WHERE NOT ("settings" ? 'memoryEnabled');
+
+-- Historical no-revision snapshots were frozen with workspace_mode = 'off'.
+-- Keep those rows valid while allowing newly accepted attempts to freeze the
+-- approval-required default below.
+ALTER TABLE "workspace_learning_policy_snapshots"
+  DROP CONSTRAINT "workspace_learning_policy_snapshots_identity_chk";
+
+ALTER TABLE "workspace_learning_policy_snapshots"
+  ADD CONSTRAINT "workspace_learning_policy_snapshots_identity_chk" CHECK (
+    (
+      "revision_id" IS NULL
+      AND "revision" IS NULL
+      AND "policy_hash" IS NULL
+      AND "activation_version" = 0
+      AND "activated_at" IS NULL
+      AND "workspace_mode" IN ('off', 'suggest')
+      AND "source_overrides" = '[]'::jsonb
+    )
+    OR (
+      "revision_id" IS NOT NULL
+      AND "revision" > 0
+      AND "policy_hash" ~ '^[0-9a-f]{64}$'
+      AND "activation_version" > 0
+      AND "activated_at" IS NOT NULL
+    )
+  ) NOT VALID;
+
+ALTER TABLE "workspace_learning_policy_snapshots"
+  VALIDATE CONSTRAINT "workspace_learning_policy_snapshots_identity_chk";
+
+CREATE OR REPLACE FUNCTION workspace_learning_policy_canonical_at(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_accepted_at timestamptz
+) RETURNS jsonb
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT CASE WHEN active."id" IS NULL THEN
+    jsonb_build_object(
+      'revisionId', NULL,
+      'revision', NULL,
+      'policyHash', NULL,
+      'activationVersion', 0,
+      'activatedAt', NULL,
+      'workspaceMode', 'suggest',
+      'sourceOverrides', '[]'::jsonb
+    )
+  ELSE
+    jsonb_build_object(
+      'revisionId', revision."id"::text,
+      'revision', revision."revision",
+      'policyHash', revision."policy_hash",
+      'activationVersion', active."activation_version",
+      'activatedAt', to_char(
+        active."created_at" AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'
+      ),
+      'workspaceMode', revision."workspace_mode",
+      'sourceOverrides', revision."source_overrides"
+    )
+  END
+  FROM (SELECT 1) singleton
+  LEFT JOIN LATERAL (
+    SELECT event.*
+    FROM "workspace_learning_policy_activation_events" event
+    WHERE event."account_id" = p_account_id
+      AND event."workspace_id" = p_workspace_id
+      AND event."created_at" <= p_accepted_at
+    ORDER BY event."created_at" DESC, event."activation_version" DESC, event."id" DESC
+    LIMIT 1
+  ) active ON true
+  LEFT JOIN "workspace_learning_policy_revisions" revision
+    ON revision."account_id" = active."account_id"
+    AND revision."workspace_id" = active."workspace_id"
+    AND revision."id" = active."new_revision_id"
+    AND revision."revision" = active."new_revision"
+    AND revision."policy_hash" = active."new_policy_hash";
+$$;
+
+REVOKE ALL ON FUNCTION workspace_learning_policy_canonical_at(uuid, uuid, timestamptz)
+  FROM PUBLIC;

package/drizzle/0394_session_selected_skill_activation.sql

@@ -0,0 +1,20 @@
+-- deployment-mode: maintenance
+-- A session-selected Skill is installed and inspectable like any other Skill,
+-- but the worker excludes it from ambient workspace resolution. An explicit
+-- session create copies the immutable artifact onto that one session.
+
+ALTER TABLE capability_facets
+  DROP CONSTRAINT capability_facets_activation_chk;
+
+ALTER TABLE capability_facets
+  ADD CONSTRAINT capability_facets_activation_chk CHECK (
+    activation_mode IN (
+      'platform_available',
+      'runtime_baseline',
+      'workspace_managed',
+      'session_selected'
+    )
+  ) NOT VALID;
+
+ALTER TABLE capability_facets
+  VALIDATE CONSTRAINT capability_facets_activation_chk;