@opengeni/db 3.7.4 → 4.0.0-canary.0

package/drizzle/0400_session_attempt_model_context_snapshots.sql

@@ -0,0 +1,65 @@
+-- deployment-mode: rolling
+-- Persist the exact model-visible instruction/tool/skill prefix captured at
+-- provider request time so the session Debug inspector can show what the
+-- agent saw, including token estimates. Content-bearing on purpose; session
+-- readers already see raw event payloads.
+
+CREATE TABLE "session_attempt_model_context_snapshots" (
+  "attempt_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "session_id" uuid NOT NULL,
+  "turn_id" uuid NOT NULL,
+  "execution_generation" integer NOT NULL,
+  "request_index" integer NOT NULL,
+  "captured_at" timestamp with time zone NOT NULL,
+  "snapshot" jsonb NOT NULL,
+  "created_at" timestamp with time zone NOT NULL,
+  "updated_at" timestamp with time zone NOT NULL,
+  CONSTRAINT "session_attempt_model_context_snapshots_attempt_owner_fk"
+    FOREIGN KEY ("account_id", "workspace_id", "session_id", "turn_id", "attempt_id")
+    REFERENCES "session_turn_attempts" ("account_id", "workspace_id", "session_id", "turn_id", "id")
+    ON DELETE CASCADE,
+  CONSTRAINT "session_attempt_model_context_snapshots_request_index_check"
+    CHECK ("request_index" > 0 AND "execution_generation" > 0),
+  CONSTRAINT "session_attempt_model_context_snapshots_size_check"
+    CHECK (octet_length("snapshot"::text) BETWEEN 2 AND 16777216),
+  CONSTRAINT "session_attempt_model_context_snapshots_identity_check"
+    CHECK (
+      jsonb_typeof("snapshot") = 'object'
+      AND "snapshot" ?& ARRAY[
+        'version', 'capturedAt', 'source', 'requestIndex', 'instructions',
+        'layers', 'tools', 'skills', 'tokens'
+      ]::text[]
+      AND ("snapshot"->>'version')::integer = 1
+      AND "snapshot"->>'source' = 'model_request'
+      AND jsonb_typeof("snapshot"->'layers') = 'array'
+      AND jsonb_typeof("snapshot"->'tools') = 'array'
+      AND jsonb_typeof("snapshot"->'skills') = 'array'
+    )
+);
+
+CREATE INDEX "session_attempt_model_context_snapshots_session_idx"
+  ON "session_attempt_model_context_snapshots" ("workspace_id", "session_id", "captured_at" DESC);
+
+ALTER TABLE "session_attempt_model_context_snapshots" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_attempt_model_context_snapshots" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "session_attempt_model_context_snapshots"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'REVOKE ALL ON TABLE %I.session_attempt_model_context_snapshots FROM opengeni_app',
+      target_schema
+    );
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE ON TABLE %I.session_attempt_model_context_snapshots TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END
+$grants$;

package/drizzle/0401_organization_user_setup_token_transport.sql

@@ -0,0 +1,178 @@
+-- deployment-mode: rolling
+-- Freeze the setup-link transport at the same first-provider boundary as the
+-- immutable payload digest. The nullable column preserves old API binaries in
+-- fragment mode; the replacement v1 claim rolls back any attempted claim of a
+-- query-frozen retry so only a 0401-aware v2 replica can service that row.
+-- New binaries recover an already-prepared legacy row by matching its digest
+-- before setting the missing transport.
+
+ALTER TABLE organization_user_setup_deliveries
+  ADD COLUMN setup_token_transport text;
+
+ALTER TABLE organization_user_setup_deliveries
+  ADD CONSTRAINT organization_user_setup_deliveries_token_transport_check
+  CHECK (setup_token_transport IS NULL OR setup_token_transport IN ('fragment', 'query'));
+
+-- Preserve the original 0351 implementation as a private implementation
+-- detail for the v2 capability. The public v1 name becomes a compatibility
+-- fence: if an old replica reaches a query-frozen row, the raised exception
+-- rolls back the nested claim/attempt changes before the transaction returns.
+ALTER FUNCTION claim_organization_user_setup_delivery(jsonb)
+  RENAME TO claim_organization_user_setup_delivery_unfenced_0401;
+ALTER FUNCTION claim_organization_user_setup_delivery_unfenced_0401(jsonb)
+  SET SCHEMA opengeni_private;
+
+CREATE FUNCTION claim_organization_user_setup_delivery(p_command jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  result jsonb;
+  delivery_id_value uuid;
+  setup_token_transport_value text;
+BEGIN
+  result := opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(
+    p_command
+  );
+  IF result ->> 'claimed' IS DISTINCT FROM 'true' THEN
+    RETURN result;
+  END IF;
+  delivery_id_value := nullif(result #>> '{delivery,id}', '')::uuid;
+  PERFORM set_config(
+    'opengeni.organization_tenancy_lifecycle', 'organization_membership_lifecycle', true
+  );
+  SELECT delivery.setup_token_transport INTO setup_token_transport_value
+  FROM organization_user_setup_deliveries delivery
+  WHERE delivery.id = delivery_id_value;
+  IF setup_token_transport_value = 'query' THEN
+    RAISE EXCEPTION
+      'query-frozen organization setup delivery requires a 0401-aware API replica'
+      USING ERRCODE = '55000';
+  END IF;
+  RETURN result;
+END
+$body$;
+
+CREATE FUNCTION claim_organization_user_setup_delivery_v2(p_command jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  result jsonb;
+  delivery_id_value uuid;
+  delivery organization_user_setup_deliveries%ROWTYPE;
+BEGIN
+  result := opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(
+    p_command
+  );
+  IF result ->> 'claimed' IS DISTINCT FROM 'true' THEN
+    RETURN result;
+  END IF;
+  delivery_id_value := nullif(result #>> '{delivery,id}', '')::uuid;
+  PERFORM set_config(
+    'opengeni.organization_tenancy_lifecycle', 'organization_membership_lifecycle', true
+  );
+  SELECT * INTO delivery FROM organization_user_setup_deliveries candidate
+  WHERE candidate.id = delivery_id_value;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'organization setup delivery is unavailable' USING ERRCODE = 'P0002';
+  END IF;
+  RETURN result || jsonb_build_object(
+    'setupTokenTransport', delivery.setup_token_transport,
+    'payloadDigest', delivery.payload_digest
+  );
+END
+$body$;
+
+CREATE FUNCTION prepare_organization_user_setup_delivery_v2(p_command jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  delivery_id_value uuid := nullif(p_command ->> 'deliveryId', '')::uuid;
+  setup_token_transport_value text := p_command ->> 'setupTokenTransport';
+  result jsonb;
+  frozen_transport text;
+BEGIN
+  IF delivery_id_value IS NULL
+    OR setup_token_transport_value IS NULL
+    OR setup_token_transport_value NOT IN ('fragment', 'query')
+  THEN
+    RAISE EXCEPTION 'organization setup delivery transport preparation is invalid'
+      USING ERRCODE = '42501';
+  END IF;
+  result := prepare_organization_user_setup_delivery(p_command);
+  UPDATE organization_user_setup_deliveries SET
+    setup_token_transport = coalesce(setup_token_transport, setup_token_transport_value)
+  WHERE id = delivery_id_value
+    AND (
+      setup_token_transport IS NULL
+      OR setup_token_transport = setup_token_transport_value
+    )
+  RETURNING setup_token_transport INTO frozen_transport;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'organization setup delivery transport changed under retry'
+      USING ERRCODE = '23505';
+  END IF;
+  RETURN result || jsonb_build_object('setupTokenTransport', frozen_transport);
+END
+$body$;
+
+DO $hardening$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema
+  );
+  EXECUTE format(
+    'ALTER FUNCTION %I.claim_organization_user_setup_delivery(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  EXECUTE format(
+    'ALTER FUNCTION %I.claim_organization_user_setup_delivery_v2(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  EXECUTE format(
+    'ALTER FUNCTION %I.prepare_organization_user_setup_delivery_v2(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    REVOKE ALL ON FUNCTION
+      opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(jsonb)
+      FROM opengeni_app;
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.claim_organization_user_setup_delivery(jsonb) TO opengeni_app',
+      data_schema
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.claim_organization_user_setup_delivery_v2(jsonb) TO opengeni_app',
+      data_schema
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.prepare_organization_user_setup_delivery_v2(jsonb) TO opengeni_app',
+      data_schema
+    );
+  END IF;
+END
+$hardening$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION claim_organization_user_setup_delivery(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION claim_organization_user_setup_delivery_v2(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION prepare_organization_user_setup_delivery_v2(jsonb) FROM PUBLIC;
+
+COMMENT ON COLUMN organization_user_setup_deliveries.setup_token_transport IS
+  'Fragment or query transport frozen at first preparation; NULL only for rolling old-binary rows pending digest recovery.';
+COMMENT ON FUNCTION claim_organization_user_setup_delivery(jsonb) IS
+  'Pre-0401 compatibility claim; rolls back query-frozen claims so a v2 replica can service them.';
+COMMENT ON FUNCTION opengeni_private.claim_organization_user_setup_delivery_unfenced_0401(jsonb) IS
+  'Private 0351 claim implementation used only by the 0401-aware v2 capability.';
+COMMENT ON FUNCTION claim_organization_user_setup_delivery_v2(jsonb) IS
+  'Rolling claim projection including the frozen setup transport and legacy payload digest.';
+COMMENT ON FUNCTION prepare_organization_user_setup_delivery_v2(jsonb) IS
+  'Prepares provider delivery and atomically freezes the setup-link transport.';