@rulemetric/local 0.13.0 → 0.14.0

package/dist/supabase/migrations/00218_backfill_session_events_model.sql

@@ -0,0 +1,30 @@
+-- 00218_backfill_session_events_model.sql — populate session_events.model from
+-- the metadata copy the Claude Code adapter has always written.
+--
+-- Measured on prod 2026-09-03 (read-only): 71,477 token-bearing session_events
+-- rows had model IS NULL, and every one of them carried the id in
+-- metadata->>'model'. The claude_code adapter (packages/session) stamped
+-- metadata.model but never the top-level event field, so /import and reimport
+-- wrote NULL into the column. The insights cost rollup
+-- (apps/api/src/routes/insights/compute.ts) keys pricing on that column and
+-- fell back to the constant claude-sonnet-4-6 for every hooks-first session —
+-- /usage reported a cost that was not the user's spend. GET /api/pricing/coverage
+-- (the weekly cron_refresh_pricing worklist) reads the same column, so those
+-- models were never even queued for a price row.
+--
+-- Keep-current half: the adapter now sets event.model and the ingest mapping
+-- writes it (same PR). This is the one-time backfill. Idempotent (touches only
+-- model IS NULL); placeholders ('', 'unknown', '<synthetic>') are skipped so
+-- they never become a cost bucket — the same set resolveModelId() rejects.
+--
+-- The deploy runner applies each file inside ONE transaction (psql -1). A DO
+-- block that loops in batches would not dodge statement_timeout — the DO block
+-- is itself one statement — so the ceiling is raised for this transaction
+-- instead, as 00095 did. ~71k rows behind a seq scan of session_events.
+SET LOCAL statement_timeout = '600s';
+
+UPDATE session_events
+SET model = metadata->>'model'
+WHERE model IS NULL
+  AND metadata->>'model' IS NOT NULL
+  AND metadata->>'model' NOT IN ('', 'unknown', '<synthetic>');

package/dist/supabase/migrations/00219_weekly_digest.sql

@@ -0,0 +1,64 @@
+-- 00219: the weekly digest email — one mail per active user per week.
+--
+-- Our first external user ran the product for five weeks and last opened the
+-- web app on day one. In that time it analysed 107 of his sessions, adopted 26
+-- blocks into his CLAUDE.md and started 9 randomised experiments on his
+-- projects, and nothing told him. The digest is the answer to "what should I
+-- be looking at week to week": numbers the server already has, plus an honest
+-- date for when each running experiment can reach a verdict. It never claims
+-- money saved or effectiveness gained (docs/architecture/effectiveness.md §12).
+--
+-- Three pieces:
+--   notification_preferences.weekly_digest  — the opt-out. Default true: the
+--                                             digest is the product telling the
+--                                             user what it did on their behalf.
+--                                             `unsubscribed_at` (the one-click
+--                                             unsubscribe) also stops it.
+--   weekly_digest_deliveries                — one row per (user, week). The
+--                                             sender reserves the row BEFORE
+--                                             calling the provider, so a crash
+--                                             between send and record cannot
+--                                             double-mail on retry.
+--   weekly_digest_runs                      — one row per week. The in-process
+--                                             scheduler CLAIMS the week with an
+--                                             INSERT ... ON CONFLICT DO NOTHING,
+--                                             so two API instances (or a
+--                                             restart mid-run) cannot both send.
+
+alter table notification_preferences
+  add column if not exists weekly_digest boolean not null default true;
+
+create table if not exists weekly_digest_deliveries (
+  user_id             uuid not null references profiles(id) on delete cascade,
+  week_start          date not null,
+  sent_at             timestamptz not null default now(),
+  provider_message_id text,
+  primary key (user_id, week_start)
+);
+
+create table if not exists weekly_digest_runs (
+  week_start  date primary key,
+  started_at  timestamptz not null default now(),
+  finished_at timestamptz,
+  sent        int,
+  skipped     int,
+  failed      int
+);
+
+-- RLS: the API reaches these through the service connection (bypasses RLS);
+-- through PostgREST a user may read their own delivery rows and a superadmin
+-- may read everything. Nothing writes through PostgREST.
+alter table weekly_digest_deliveries enable row level security;
+alter table weekly_digest_runs       enable row level security;
+
+drop policy if exists weekly_digest_deliveries_own_read on weekly_digest_deliveries;
+create policy weekly_digest_deliveries_own_read on weekly_digest_deliveries for select
+  using (user_id = auth.uid());
+
+drop policy if exists weekly_digest_deliveries_superadmin_read on weekly_digest_deliveries;
+create policy weekly_digest_deliveries_superadmin_read on weekly_digest_deliveries for select
+  using (exists (select 1 from profiles where id = auth.uid() and is_superadmin = true));
+
+drop policy if exists weekly_digest_runs_superadmin_read on weekly_digest_runs;
+create policy weekly_digest_runs_superadmin_read on weekly_digest_runs for select
+  using (exists (select 1 from profiles where id = auth.uid() and is_superadmin = true));

package/dist/supabase/migrations/00220_snapshot_payload_lifecycle.sql

@@ -0,0 +1,107 @@
+-- Snapshot payload lifecycle: compact capture heads, durable Storage intents,
+-- and explicit expiry state. These DDL statements are additive and idempotent
+-- so a local replay and an additive production rollout share the same schema.
+
+create table if not exists session_capture_heads (
+  session_id uuid primary key references sessions(id) on delete cascade,
+  sequence integer not null,
+  raw_message_hashes jsonb not null,
+  version integer not null,
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists snapshot_delta_objects (
+  ref text primary key,
+  -- NULL deliberately permits a catalog record for a shared legacy ref.
+  snapshot_id uuid,
+  compressed_bytes integer not null,
+  state text not null,
+  created_at timestamptz not null default now(),
+  last_attempt_at timestamptz,
+  attempts integer not null default 0,
+  last_error text
+);
+
+alter table context_snapshots
+  add column if not exists messages_base_length integer,
+  add column if not exists payload_pruned_at timestamptz,
+  add column if not exists delta_offload_state text not null default 'inline',
+  add column if not exists delta_gzip_bytes integer,
+  add column if not exists delta_offload_error text,
+  add column if not exists delta_offload_attempts integer not null default 0;
+
+alter table content_blobs
+  add column if not exists last_referenced_at timestamptz not null default now();
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint where conname = 'context_snapshots_delta_offload_state_check'
+  ) then
+    alter table context_snapshots add constraint context_snapshots_delta_offload_state_check
+      check (delta_offload_state in ('inline', 'pending', 'offloaded', 'expired'));
+  end if;
+  if not exists (
+    select 1 from pg_constraint where conname = 'snapshot_delta_objects_state_check'
+  ) then
+    alter table snapshot_delta_objects add constraint snapshot_delta_objects_state_check
+      check (state in ('uploading', 'ready', 'delete_pending', 'failed'));
+  end if;
+end $$;
+
+update context_snapshots
+set delta_offload_state = case
+  when payload_pruned_at is not null
+       or (messages_delta is null and messages_delta_ref is null) then 'expired'
+  when messages_delta_ref is not null then 'offloaded'
+  else 'inline'
+end;
+
+-- Production: build these outside a migration transaction with CONCURRENTLY.
+-- Local migration replay creates their equivalent indexes synchronously.
+create index if not exists idx_snapshots_unpruned_captured
+  on context_snapshots (captured_at, id)
+  where payload_pruned_at is null;
+create index if not exists idx_snapshots_pending_offload
+  on context_snapshots (delta_offload_state, captured_at, id)
+  where delta_offload_state = 'pending';
+create index if not exists idx_snapshots_delta_ref
+  on context_snapshots (messages_delta_ref)
+  where messages_delta_ref is not null;
+create index if not exists idx_snapshot_delta_objects_state_created
+  on snapshot_delta_objects (state, created_at);
+create unique index if not exists snapshot_delta_objects_snapshot_id_unique
+  on snapshot_delta_objects (snapshot_id)
+  where snapshot_id is not null;
+
+create or replace function public.cleanup_stale_session_capture_heads()
+returns bigint
+language plpgsql
+security definer
+set search_path = public
+as $function$
+declare
+  removed bigint;
+begin
+  delete from session_capture_heads head
+  using sessions session
+  where head.session_id = session.id
+    and head.updated_at < now() - interval '14 days'
+    and (session.ended_at is not null or session.started_at < now() - interval '14 days');
+  get diagnostics removed = row_count;
+  return removed;
+end;
+$function$;
+
+do $$
+begin
+  if exists (select 1 from cron.job where jobname = 'cleanup-stale-session-capture-heads') then
+    perform cron.unschedule('cleanup-stale-session-capture-heads');
+  end if;
+end $$;
+
+select cron.schedule(
+  'cleanup-stale-session-capture-heads',
+  '30 4 * * *',
+  $$select public.cleanup_stale_session_capture_heads()$$
+);

package/dist/supabase/migrations/00221_snapshot_payload_expiry.sql

@@ -0,0 +1,34 @@
+-- Expiry is a marker-first operation: readers stop resolving raw payloads as
+-- soon as this runs, while the Node collector retains the object reference
+-- until Storage confirms deletion.
+create or replace function public.prune_old_snapshot_content(p_batch_size integer default 1000)
+returns text
+language plpgsql
+security definer
+set search_path = public
+as $function$
+declare
+  v_count bigint;
+begin
+  with candidates as (
+    select id
+    from context_snapshots
+    where payload_pruned_at is null
+      and captured_at < now() - interval '90 days'
+    order by captured_at, id
+    limit p_batch_size
+  )
+  update context_snapshots snapshot
+  set payload_pruned_at = now(),
+      delta_offload_state = 'expired',
+      messages_delta = null,
+      messages_summary = '[]'::jsonb,
+      system_prompt = '',
+      tools = '[]'::jsonb,
+      injected_instructions = '[]'::jsonb
+  from candidates
+  where snapshot.id = candidates.id;
+  get diagnostics v_count = row_count;
+  return format('marked %s snapshot payloads expired', v_count);
+end;
+$function$;

package/dist/supabase/migrations/00222_memory_experiment_engine.sql

@@ -0,0 +1,20 @@
+-- Pin controlled memory experiments to one harness. Without this field, every
+-- row implicitly ran Claude and there was no supported way to ask whether the
+-- same memory format improves outcomes within Codex or Pi.
+alter table public.memory_experiments
+  add column if not exists engine text not null default 'claude';
+
+do $block$
+begin
+  if not exists (
+    select 1
+    from pg_constraint
+    where conname = 'memory_experiments_engine_check'
+      and conrelid = 'public.memory_experiments'::regclass
+  ) then
+    alter table public.memory_experiments
+      add constraint memory_experiments_engine_check
+      check (engine in ('claude', 'codex', 'pi'));
+  end if;
+end
+$block$;

package/dist/supabase/migrations/00223_measurement_preferences.sql

@@ -0,0 +1,21 @@
+ALTER TABLE public.profiles ADD COLUMN measurement_preferences jsonb;
+ALTER TABLE public.profiles ADD CONSTRAINT profiles_measurement_preferences_check CHECK (
+  measurement_preferences IS NULL OR (
+    jsonb_typeof(measurement_preferences) = 'object'
+    AND measurement_preferences ?& ARRAY['engine', 'model']
+    AND (measurement_preferences - 'engine' - 'model') = '{}'::jsonb
+    AND (
+      (measurement_preferences->'engine' = 'null'::jsonb AND measurement_preferences->'model' = 'null'::jsonb)
+      OR (
+        measurement_preferences->>'engine' IN ('claude', 'codex')
+        AND (
+          (measurement_preferences->>'engine' = 'claude' AND measurement_preferences->'model' = 'null'::jsonb)
+          OR (jsonb_typeof(measurement_preferences->'model') = 'string'
+              AND length(btrim(measurement_preferences->>'model')) BETWEEN 1 AND 200)
+        )
+      )
+    )
+  ) IS TRUE
+);
+COMMENT ON COLUMN public.profiles.measurement_preferences IS
+  'Explicit engine/model for future measurement jobs. NULL retains legacy behavior. Does not grant scheduling, spending, or rewrite consent.';

package/dist/supabase/migrations/00224_measurement_job_snapshots.sql

@@ -0,0 +1,246 @@
+-- Immutable selection for NEW jobs only. Existing payloads and all producer
+-- eligibility predicates from 00210 remain unchanged.
+create or replace function public.measurement_execution_for_user(owner_id uuid, workload text)
+returns jsonb
+language plpgsql stable
+set search_path = public
+as $$
+declare preference jsonb;
+begin
+  if workload not in ('eval', 'harbor') then
+    raise exception 'Unknown measurement workload: %', workload;
+  end if;
+  select measurement_preferences into preference from public.profiles where id = owner_id;
+  if preference is null or preference->>'engine' is null then return null; end if;
+  return jsonb_build_object(
+    'version', 1,
+    'engine', preference->>'engine',
+    'model', coalesce(nullif(btrim(preference->>'model'), ''),
+                      case when workload = 'harbor' then 'claude-haiku-4-5' else null end),
+    'source', 'account'
+  );
+end;
+$$;
+revoke all on function public.measurement_execution_for_user(uuid, text) from public, anon, authenticated;
+grant execute on function public.measurement_execution_for_user(uuid, text) to service_role;
+
+-- Keep a canonical model attached to the engine that supplied its evidence.
+-- Explicit historical model-only pins still mean Claude; inferred GPT judges
+-- must not acquire that legacy default on their second scheduled batch.
+create or replace function public.eval_target_judge_engine(p_target_id uuid)
+returns text
+language sql stable security definer
+set search_path = public
+as $$
+  with target as (
+    select nullif(btrim(metadata->>'graderModel'), '') as pin,
+      coalesce(metadata->>'graderEngine', 'claude') as pin_engine,
+      public.eval_target_judge_segment(id) as elected_model
+    from eval_targets where id = p_target_id
+  ), elector as (
+    select r.grading->>'judge_model' as model,
+      coalesce(r.grading->>'judge_engine', 'claude') as engine, r.created_at,
+      (r.grading->>'judge_model_requested' is null
+        or r.grading->>'judge_model_requested' = r.grading->>'judge_model') as clean,
+      case when jsonb_typeof(r.grading->'expectations') = 'array' then (
+        select count(*) from jsonb_array_elements(r.grading->'expectations') e
+        where coalesce(e->>'method', 'llm') = 'llm'
+          and coalesce(e->>'errored', 'false') <> 'true'
+      ) else 0 end as llm_total,
+      (select count(*) from eval_grade_annotations a
+        where a.eval_target_id = p_target_id and a.eval_run_id = r.id
+          and a.judge_method = 'llm') as llm_annotated
+    from eval_runs r
+    where r.eval_target_id = p_target_id and r.status = 'completed'
+      and r.configuration in ('with_target', 'without_target')
+      and r.grading->>'judge_model' is not null
+  ), eligible as (
+    select e.* from elector e
+    where (e.clean or not exists (select 1 from elector where clean))
+      and e.model = (select elected_model from target)
+  )
+  select case when t.pin is not null then t.pin_engine else (
+    select engine from eligible group by engine
+    order by count(*) filter (where llm_total > 0 and llm_annotated >= llm_total) desc,
+      max(created_at) desc, engine desc limit 1
+  ) end from target t;
+$$;
+revoke all on function public.eval_target_judge_engine(uuid) from public, anon, authenticated;
+grant execute on function public.eval_target_judge_engine(uuid) to service_role;
+
+-- ── enqueue_instruction_evolution, health gates now read from the view ───────
+create or replace function public.enqueue_instruction_evolution()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with health_ok as (
+    select t.id, t.user_id
+    from eval_targets t
+    where coalesce(t.metadata->>'autoEvolvePaused', 'false') <> 'true'
+      -- Health 2a/2b/2c: ONE definition (00210), shared with eval autorun.
+      and exists (
+        select 1 from public.healthy_eval_targets h where h.eval_target_id = t.id
+      )
+      -- Live cases to measure against — at least MIN_LIVE_CASES (3).
+      -- `exists` (>= 1) was the bug: see 00183's header.
+      and (
+        select count(*) from evals ev
+        where ev.eval_target_id = t.id and ev.retired_at is null
+      ) >= 3
+      -- Change budget (cheap exclusion; the API is the authority).
+      and (
+        select count(*)
+        from instruction_promotions p
+        where p.eval_target_id = t.id
+          and p.applied
+          and p.created_at > now() - interval '7 days'
+      ) < 3
+      -- One in flight at a time.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_instruction_evolution'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'evalTargetId' = t.id::text
+      )
+  ),
+  manual as (
+    -- The hand-picked path, unchanged and uncapped.
+    select h.id, h.user_id
+    from health_ok h
+    join eval_targets t on t.id = h.id
+    where coalesce(t.metadata->>'autoEvolveEnabled', 'false') = 'true'
+  ),
+  auto_ranked as (
+    -- The stated rule. Round-robin: never-decided first (nulls first), then
+    -- least-recently-decided, so the cap rotates through the candidate pool
+    -- instead of re-measuring the same winners nightly.
+    select h.id, h.user_id,
+           row_number() over (
+             partition by h.user_id
+             order by (
+               select max(p.created_at)
+               from instruction_promotions p
+               where p.eval_target_id = h.id
+             ) asc nulls first,
+             h.id
+           ) as rn
+    from health_ok h
+    join eval_targets t on t.id = h.id
+    where t.type = 'instruction'
+      and coalesce(t.metadata->>'autoEvolveOptOut', 'false') <> 'true'
+      -- Not already covered by the manual path.
+      and coalesce(t.metadata->>'autoEvolveEnabled', 'false') <> 'true'
+      -- ACTIVE (00145's load-bearing gate): a run in the last 30 days.
+      and exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '30 days'
+      )
+  ),
+  eligible as (
+    select id, user_id from manual
+    union
+    select id, user_id from auto_ranked where rn <= 3
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_evolution',
+           'pending',
+           jsonb_build_object('evalTargetId', e.id::text)
+             || case
+                  when public.eval_target_judge_segment(e.id) is not null
+                    then jsonb_build_object(
+                           'graderModel', public.eval_target_judge_segment(e.id),
+                           'graderEngine', public.eval_target_judge_engine(e.id))
+                  else '{}'::jsonb
+                end
+             || case when public.measurement_execution_for_user(e.user_id, 'eval') is null
+                     then '{}'::jsonb
+                     else jsonb_build_object('measurement', public.measurement_execution_for_user(e.user_id, 'eval')) end,
+           'instruction-evolution:' || e.id::text
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_evolution() is
+  'Daily producer for cron_instruction_evolution. Health gates 2a/2b/2c come from the healthy_eval_targets view (00210); pause, live-cases floor (>=3, 00183), change budget, round-robin enrolment and in-flight dedupe stay here. Judge segment from eval_target_judge_segment() (00193).';
+
+-- ── enqueue_eval_autorun, health gates now read from the view ────────────────
+create or replace function public.enqueue_eval_autorun()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select t.id, t.user_id,
+      -- Canonical segment (00193). Was an inline "most recent stamped run"
+      -- subquery, which is how a credit-exhaustion fallback became the pin.
+      public.eval_target_judge_segment(t.id) as current_judge,
+      public.eval_target_judge_engine(t.id) as current_judge_engine
+    from eval_targets t
+    where coalesce(t.metadata->>'autoRunEnabled', 'false') = 'true'
+      -- Gate 0 (00190): the target must be anchored to something a promotion
+      -- could land on. Without this, a batch is two LLM executions plus a
+      -- judged grade spent to rewrite a row nothing reads.
+      and (
+        t.instruction_id is not null
+        or t.project_path is not null
+        or t.name like '/%'
+      )
+      -- Gates 2a/2b/2c: ONE definition (00210), shared with evolution.
+      and exists (
+        select 1 from public.healthy_eval_targets h where h.eval_target_id = t.id
+      )
+      -- Gate 3: the target has live cases to actually run.
+      and exists (
+        select 1 from evals ev
+        where ev.eval_target_id = t.id and ev.retired_at is null
+      )
+      -- One in flight at a time, per the 00083/00086 pattern.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_eval_autorun'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'evalTargetId' = t.id::text
+      )
+  ), ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_eval_autorun',
+           'pending',
+           jsonb_build_object('evalTargetId', e.id::text, 'maxRuns', 12)
+             || case
+                  when e.current_judge is not null
+                    then jsonb_build_object('graderModel', e.current_judge, 'graderEngine', e.current_judge_engine)
+                  else '{}'::jsonb
+                end
+             || case when public.measurement_execution_for_user(e.user_id, 'eval') is null
+                     then '{}'::jsonb
+                     else jsonb_build_object('measurement', public.measurement_execution_for_user(e.user_id, 'eval')) end,
+           'eval-autorun:' || e.id::text
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_eval_autorun() is
+  'Daily producer for cron_eval_autorun. Health gates 2a/2b/2c come from the healthy_eval_targets view (00210); the anchor gate (00190), live-cases exists, judge segment (00193) and in-flight dedupe stay here.';