@rulemetric/local 0.14.2 → 0.15.1

package/dist/supabase/migrations/00230_frozen_performance_studies.sql

@@ -0,0 +1,99 @@
+-- A parent only for the cross-case/job/result relationships not held by one eval.
+CREATE TABLE performance_studies (
+ id uuid PRIMARY KEY DEFAULT gen_random_uuid(), user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+ eval_target_id uuid NOT NULL REFERENCES eval_targets(id) ON DELETE CASCADE,
+ project_path text NOT NULL, protocol jsonb NOT NULL, protocol_hash text NOT NULL,
+ result jsonb, finalized_at timestamptz,
+ created_at timestamptz NOT NULL DEFAULT now(),
+ CONSTRAINT performance_study_version CHECK (protocol->>'version' = '1'),
+ CONSTRAINT performance_study_hash CHECK (protocol_hash ~ '^[a-f0-9]{64}$')
+);
+CREATE UNIQUE INDEX performance_studies_protocol_unique ON performance_studies(user_id,eval_target_id,protocol_hash);
+ALTER TABLE performance_studies ENABLE ROW LEVEL SECURITY;
+-- Writes go through the API validation boundary; REST clients cannot replace
+-- or erase protocols to bypass frozen lineage and final-result guards.
+CREATE POLICY performance_studies_owner ON performance_studies FOR SELECT USING (auth.uid()=user_id);
+CREATE FUNCTION preserve_study_protocol() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+BEGIN
+ IF (to_jsonb(NEW)-'result'-'finalized_at') IS DISTINCT FROM (to_jsonb(OLD)-'result'-'finalized_at') OR OLD.result IS NOT NULL THEN
+   RAISE EXCEPTION 'Frozen study protocols and final results are immutable; create a new revision';
+ END IF;
+ IF NEW.result IS NULL OR NEW.finalized_at IS NULL THEN RAISE EXCEPTION 'Final result and timestamp are required together'; END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER performance_study_immutable BEFORE UPDATE ON performance_studies FOR EACH ROW EXECUTE FUNCTION preserve_study_protocol();
+
+-- Route guards give a friendly response; this also fences refinement/SQL writers.
+CREATE FUNCTION preserve_frozen_study_case() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+BEGIN
+ IF EXISTS (SELECT 1 FROM performance_studies s, jsonb_array_elements(s.protocol->'tasks') t
+   WHERE s.eval_target_id=OLD.eval_target_id AND t->>'evalId'=OLD.id::text
+   AND EXISTS (SELECT 1 FROM auth.users u WHERE u.id=s.user_id)) THEN
+   IF TG_OP='DELETE' OR NEW IS DISTINCT FROM OLD THEN
+     RAISE EXCEPTION 'Frozen study cases cannot be edited, retired or deleted';
+   END IF;
+ END IF;
+ IF TG_OP='DELETE' THEN RETURN OLD; END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER performance_study_case_immutable BEFORE UPDATE OR DELETE ON evals FOR EACH ROW EXECUTE FUNCTION preserve_frozen_study_case();
+-- One execution budget per frozen revision. Retries resume the same job.
+CREATE UNIQUE INDEX eval_jobs_study_unique ON eval_jobs(user_id,(payload->'study'->>'id')) WHERE payload->'study'->>'id' IS NOT NULL;
+CREATE FUNCTION preserve_study_job_snapshot() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+BEGIN
+ IF OLD.payload->'study' IS NOT NULL AND NEW.payload IS DISTINCT FROM OLD.payload THEN
+   RAISE EXCEPTION 'Queued study snapshot is immutable';
+ END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER study_job_snapshot_immutable BEFORE UPDATE ON eval_jobs FOR EACH ROW EXECUTE FUNCTION preserve_study_job_snapshot();
+
+CREATE FUNCTION preserve_study_observation() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+BEGIN
+ IF OLD.outputs->'study' IS NOT NULL AND (NEW.outputs IS DISTINCT FROM OLD.outputs OR NEW.eval_id IS DISTINCT FROM OLD.eval_id OR NEW.job_id IS DISTINCT FROM OLD.job_id OR NEW.configuration IS DISTINCT FROM OLD.configuration OR NEW.run_number IS DISTINCT FROM OLD.run_number OR NEW.iteration IS DISTINCT FROM OLD.iteration OR NEW.eval_target_id IS DISTINCT FROM OLD.eval_target_id OR NEW.eval_target_version IS DISTINCT FROM OLD.eval_target_version OR NEW.status IS DISTINCT FROM OLD.status) THEN
+   RAISE EXCEPTION 'Study observations are immutable; retain exclusions and append a new protocol revision';
+ END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER study_observation_immutable BEFORE UPDATE ON eval_runs FOR EACH ROW EXECUTE FUNCTION preserve_study_observation();
+
+-- Reserve each actor invocation before spawning it. A lost acknowledgement or
+-- crashed worker consumes the slot: repeating an unknown call would overspend
+-- and selectively replace missing outcomes. Reservations survive job retries.
+CREATE TABLE performance_study_calls (
+ id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+ study_id uuid NOT NULL REFERENCES performance_studies(id) ON DELETE CASCADE,
+ job_id uuid NOT NULL REFERENCES eval_jobs(id) ON DELETE CASCADE,
+ task_id text NOT NULL, arm text NOT NULL CHECK (arm IN ('baseline','treatment')),
+ repetition integer NOT NULL CHECK (repetition > 0),
+ reserved_at timestamptz NOT NULL DEFAULT now(),
+ UNIQUE(study_id,task_id,arm,repetition)
+);
+ALTER TABLE performance_study_calls ENABLE ROW LEVEL SECURITY;
+CREATE POLICY performance_study_calls_owner ON performance_study_calls FOR SELECT USING (
+ EXISTS (SELECT 1 FROM performance_studies s WHERE s.id=study_id AND s.user_id=auth.uid())
+);
+
+-- Serialize result insertion with the existing job's terminal transition.
+-- A GET sealing a terminal study cannot miss a concurrently accepted run.
+CREATE FUNCTION guard_study_observation_insert() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+DECLARE execution_status text;
+BEGIN
+ IF NEW.outputs->'study' IS NOT NULL THEN
+  SELECT status INTO execution_status FROM eval_jobs WHERE id=NEW.job_id FOR UPDATE;
+  IF execution_status IS DISTINCT FROM 'running' THEN
+   RAISE EXCEPTION 'Study observations require an active execution';
+  END IF;
+ END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER study_observation_active BEFORE INSERT ON eval_runs FOR EACH ROW EXECUTE FUNCTION guard_study_observation_insert();
+
+CREATE FUNCTION preserve_study_history() RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $$
+BEGIN
+ IF EXISTS (SELECT 1 FROM auth.users WHERE id=OLD.user_id) THEN
+  RAISE EXCEPTION 'Frozen study history cannot be deleted while the account exists';
+ END IF;
+ RETURN OLD;
+END $$;
+CREATE TRIGGER performance_study_history BEFORE DELETE ON performance_studies FOR EACH ROW EXECUTE FUNCTION preserve_study_history();

package/dist/supabase/migrations/00231_scoped_live_confirmations.sql

@@ -0,0 +1,47 @@
+-- P4/P5: pre-treatment organic task eligibility and the auditable link from a
+-- supported frozen study to a later application.  Legacy instruction arms are
+-- intentionally not backfilled: they lack the task/configuration contract.
+create table public.scoped_live_confirmations (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  experiment_id uuid not null references public.instruction_experiments(id) on delete cascade,
+  source_study_id uuid not null references public.performance_studies(id) on delete restrict,
+  protocol jsonb not null,
+  protocol_hash text not null,
+  salt text not null,
+  status text not null default 'running' check (status in ('running','stopped')),
+  decision text check (decision is null or decision in ('improved','harmful','inconclusive')),
+  decision_detail jsonb,
+  started_at timestamptz not null default now(),
+  ended_at timestamptz,
+  unique (experiment_id)
+);
+create index scoped_live_confirmations_user_status on public.scoped_live_confirmations(user_id,status);
+
+create table public.scoped_live_confirmation_assignments (
+  id uuid primary key default gen_random_uuid(),
+  confirmation_id uuid not null references public.scoped_live_confirmations(id) on delete cascade,
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  task_id text not null,
+  external_session_id text not null,
+  arm text not null check (arm in ('treated','control')),
+  model text not null,
+  configuration_hash text not null,
+  assigned_at timestamptz not null default now(),
+  delivery_hash text,
+  delivered_at timestamptz,
+  outcome text check (outcome is null or outcome in ('completed','failed','unknown')),
+  outcome_detail jsonb,
+  outcome_at timestamptz,
+  unique (confirmation_id,task_id),
+  unique (confirmation_id,external_session_id)
+);
+create index scoped_live_confirmation_assignments_confirmation_arm
+  on public.scoped_live_confirmation_assignments(confirmation_id,arm);
+
+alter table public.recommendation_applications
+  add column source_study_id uuid references public.performance_studies(id) on delete restrict,
+  add column scoped_confirmation_id uuid references public.scoped_live_confirmations(id) on delete restrict,
+  add column scoped_confirmation_assignment_id uuid references public.scoped_live_confirmation_assignments(id) on delete restrict;
+create index idx_recommendation_applications_scoped_confirmation
+  on public.recommendation_applications(scoped_confirmation_id, scoped_confirmation_assignment_id);

package/dist/supabase/migrations/00232_scoped_live_confirmation_disposition.sql

@@ -0,0 +1,13 @@
+-- A legacy project-wide experiment is closed when a task-level P4 protocol
+-- takes over. Its old arms remain historical evidence; this reason prevents
+-- the ordinary renderer from continuing to inject alongside scoped assignment.
+alter table public.instruction_experiments
+  drop constraint instruction_experiments_stopped_reason_check;
+
+alter table public.instruction_experiments
+  add constraint instruction_experiments_stopped_reason_check
+  check (stopped_reason in (
+    'graduated', 'trial_neutral', 'trial_inconclusive', 'content_changed',
+    'inactive_project', 'invalid_template', 'delivery_refused',
+    'scoped_live_confirmation'
+  ));

package/dist/supabase/migrations/00233_performance_study_integrity.sql

@@ -0,0 +1,33 @@
+-- Close insert-time gaps left by 00230. A CHECK whose expression evaluates to
+-- NULL accepts the row, so the version key must be required explicitly.
+alter table public.performance_studies
+  drop constraint performance_study_version;
+alter table public.performance_studies
+  add constraint performance_study_version
+  check (protocol ? 'version' and protocol->>'version' = '1');
+alter table public.performance_studies
+  add constraint performance_study_finalization_pair
+  check ((result is null) = (finalized_at is null));
+
+create or replace function public.preserve_study_protocol() returns trigger
+language plpgsql security definer set search_path = public, pg_temp as $$
+begin
+  if tg_op = 'INSERT' then
+    if new.result is not null or new.finalized_at is not null then
+      raise exception 'Studies must be frozen before a result can be finalized';
+    end if;
+    return new;
+  end if;
+  if (to_jsonb(new)-'result'-'finalized_at') is distinct from (to_jsonb(old)-'result'-'finalized_at') or old.result is not null then
+    raise exception 'Frozen study protocols and final results are immutable; create a new revision';
+  end if;
+  if new.result is null or new.finalized_at is null then
+    raise exception 'Final result and timestamp are required together';
+  end if;
+  return new;
+end $$;
+
+drop trigger performance_study_immutable on public.performance_studies;
+create trigger performance_study_immutable
+before insert or update on public.performance_studies
+for each row execute function public.preserve_study_protocol();

package/dist/supabase/migrations/00234_scoped_live_confirmation_rls.sql

@@ -0,0 +1,20 @@
+-- Scoped study rows contain experiment arms and outcomes. Browser clients may
+-- read their own evidence; all writes remain behind the authenticated API.
+alter table public.scoped_live_confirmations enable row level security;
+alter table public.scoped_live_confirmation_assignments enable row level security;
+
+create policy scoped_live_confirmations_select_own
+  on public.scoped_live_confirmations for select
+  using (auth.uid() = user_id);
+
+create policy scoped_live_confirmation_assignments_select_own
+  on public.scoped_live_confirmation_assignments for select
+  using (auth.uid() = user_id);
+
+alter table public.scoped_live_confirmation_assignments
+  add constraint scoped_live_delivery_pair
+    check ((delivery_hash is null) = (delivered_at is null)),
+  add constraint scoped_live_outcome_pair
+    check ((outcome is null) = (outcome_at is null)),
+  add constraint scoped_live_outcome_requires_delivery
+    check (outcome_at is null or delivered_at is not null);

package/dist/supabase/migrations/00235_scoped_live_observed_environment.sql

@@ -0,0 +1,4 @@
+-- Retain the actual pre-treatment environment separately from the requested
+-- fingerprint; legacy assignments without this evidence cannot certify effect.
+alter table public.scoped_live_confirmation_assignments
+  add column enrollment_evidence jsonb;

package/dist/supabase/migrations/00236_scoped_live_followup_receipts.sql

@@ -0,0 +1,3 @@
+-- Follow-up delivery is auditable but never another randomized observation.
+alter table public.scoped_live_confirmation_assignments
+  add column phase text not null default 'trial' check (phase in ('trial', 'followup'));

package/dist/supabase/migrations/00237_scoped_live_frozen_evidence.sql

@@ -0,0 +1,27 @@
+-- API-only writers still need immutable protocol and once-only evidence guards.
+create or replace function public.guard_scoped_live_confirmation() returns trigger
+language plpgsql set search_path = public as $$
+begin
+  if row(new.id,new.user_id,new.experiment_id,new.source_study_id,new.protocol,new.protocol_hash,new.salt,new.started_at)
+     is distinct from row(old.id,old.user_id,old.experiment_id,old.source_study_id,old.protocol,old.protocol_hash,old.salt,old.started_at)
+     or old.status = 'stopped' then
+    raise exception 'Scoped confirmation protocol and final decision are immutable';
+  end if;
+  return new;
+end $$;
+create trigger scoped_live_confirmation_frozen before update on public.scoped_live_confirmations
+for each row execute function public.guard_scoped_live_confirmation();
+
+create or replace function public.guard_scoped_live_assignment() returns trigger
+language plpgsql set search_path = public as $$
+begin
+  if row(new.id,new.confirmation_id,new.user_id,new.task_id,new.external_session_id,new.arm,new.phase,new.model,new.configuration_hash,new.enrollment_evidence,new.assigned_at)
+     is distinct from row(old.id,old.confirmation_id,old.user_id,old.task_id,old.external_session_id,old.arm,old.phase,old.model,old.configuration_hash,old.enrollment_evidence,old.assigned_at)
+     or (old.delivered_at is not null and row(new.delivered_at,new.delivery_hash) is distinct from row(old.delivered_at,old.delivery_hash))
+     or (old.outcome_at is not null and row(new.outcome_at,new.outcome,new.outcome_detail) is distinct from row(old.outcome_at,old.outcome,old.outcome_detail)) then
+    raise exception 'Scoped assignment identity, delivery and outcome evidence are immutable';
+  end if;
+  return new;
+end $$;
+create trigger scoped_live_assignment_frozen before update on public.scoped_live_confirmation_assignments
+for each row execute function public.guard_scoped_live_assignment();