@straiffi/archon 1.10.1 → 1.10.2

package/dist/server/db.js

@@ -36,6 +36,7 @@ db.exec(`
     kind         TEXT NOT NULL DEFAULT 'worktree',
     reviewer_model TEXT,
     reviewer_variant TEXT,
+    reviewer_models_json TEXT,
     created_at   DATETIME DEFAULT CURRENT_TIMESTAMP,
     updated_at   DATETIME DEFAULT CURRENT_TIMESTAMP
   )
@@ -75,8 +76,10 @@ db.exec(`
     preview_capability_mode TEXT,
     helper_model TEXT,
     helper_variant TEXT,
+    helper_models_json TEXT,
     reviewer_model TEXT,
     reviewer_variant TEXT,
+    reviewer_models_json TEXT,
     commit_message_rules TEXT,
     commit_after_each_ticket INTEGER NOT NULL DEFAULT 0,
     auto_park_stale_tickets INTEGER NOT NULL DEFAULT 0,
@@ -146,6 +149,7 @@ ensureColumn('worktree_bundles', 'automation_pause_on_open_questions', 'INTEGER'
 ensureColumn('worktree_bundles', 'automation_review_max_iterations', 'INTEGER');
 ensureColumn('worktree_bundles', 'reviewer_model', 'TEXT');
 ensureColumn('worktree_bundles', 'reviewer_variant', 'TEXT');
+ensureColumn('worktree_bundles', 'reviewer_models_json', 'TEXT');
 ensureColumn('worktree_bundles', 'required_check_policy_override', 'TEXT');
 db.exec('UPDATE worktree_bundles SET required_check_policy_override = NULL WHERE required_check_policy_override IS NOT NULL');
 ensureColumn('projects', 'worktree_sync', 'TEXT');
@@ -162,8 +166,10 @@ ensureColumn('projects', 'auto_fix_check_definition_ids', "TEXT NOT NULL DEFAULT
 ensureColumn('projects', 'test_commands', 'TEXT');
 ensureColumn('projects', 'helper_model', 'TEXT');
 ensureColumn('projects', 'helper_variant', 'TEXT');
+ensureColumn('projects', 'helper_models_json', 'TEXT');
 ensureColumn('projects', 'reviewer_model', 'TEXT');
 ensureColumn('projects', 'reviewer_variant', 'TEXT');
+ensureColumn('projects', 'reviewer_models_json', 'TEXT');
 ensureColumn('projects', 'commit_message_rules', 'TEXT');
 ensureColumn('projects', 'commit_after_each_ticket', 'INTEGER NOT NULL DEFAULT 0');
 ensureColumn('projects', 'preview_service_name', 'TEXT');
@@ -177,6 +183,33 @@ ensureColumn('projects', 'spec_aware_code_review_enabled', 'INTEGER NOT NULL DEF
 ensureColumn('projects', 'deletion_started_at', 'DATETIME');
 ensureColumn('projects', 'deletion_claim_id', 'TEXT');
 ensureColumn('projects', 'deletion_cleanup_started_at', 'DATETIME');
+const backfillAgentModelMaps = () => {
+    db.transaction(() => {
+        db.exec(`
+      UPDATE projects
+      SET helper_models_json = CASE
+        WHEN helper_model IS NULL THEN '{}'
+        ELSE json_object('opencode', json_object('model', helper_model, 'variant', helper_variant))
+      END
+      WHERE helper_models_json IS NULL;
+
+      UPDATE projects
+      SET reviewer_models_json = CASE
+        WHEN reviewer_model IS NULL THEN '{}'
+        ELSE json_object('opencode', json_object('model', reviewer_model, 'variant', reviewer_variant))
+      END
+      WHERE reviewer_models_json IS NULL;
+
+      UPDATE worktree_bundles
+      SET reviewer_models_json = CASE
+        WHEN reviewer_model IS NULL THEN '{}'
+        ELSE json_object('opencode', json_object('model', reviewer_model, 'variant', reviewer_variant))
+      END
+      WHERE reviewer_models_json IS NULL;
+    `);
+    })();
+};
+backfillAgentModelMaps();
 db.exec(`
   CREATE TABLE IF NOT EXISTS execution_profile_revisions (
     id             TEXT PRIMARY KEY,
@@ -5189,6 +5222,613 @@ ensureColumn('bundle_automation_state', 'automation_progression_run_id', 'TEXT')
 ensureColumn('bundle_automation_state', 'automation_paused_stage_run_id', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_paused_boundary_purpose', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_pause_reason_code', 'TEXT');
+db.exec('DROP TRIGGER IF EXISTS validate_review_repair_result_update');
+db.exec('DROP TRIGGER IF EXISTS validate_review_repair_gate_update');
+db.exec('DROP TRIGGER IF EXISTS validate_review_repair_gate_evaluation_update');
+db.exec('DROP TRIGGER IF EXISTS validate_review_repair_verification_update');
+db.exec('DROP TRIGGER IF EXISTS validate_review_repair_phase_update');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS review_repair_iterations (
+    id                                  TEXT PRIMARY KEY,
+    project_id                          TEXT NOT NULL,
+    worktree_bundle_id                  TEXT NOT NULL,
+    owner_ticket_id                     TEXT NOT NULL,
+    automation_progression_run_id       TEXT NOT NULL,
+    ordinal                             INTEGER NOT NULL,
+    triggering_review_execution_run_id  TEXT NOT NULL,
+    triggering_review_run_id            TEXT NOT NULL,
+    action_envelope_run_id              TEXT,
+    action_run_id                       TEXT,
+    gate_batch_run_id                   TEXT,
+    gate_source_batch_run_id            TEXT,
+    gate_evaluation_id                  TEXT,
+    resulting_review_execution_run_id   TEXT,
+    resulting_review_run_id             TEXT,
+    triggering_blocking_count           INTEGER NOT NULL,
+    resulting_blocking_count            INTEGER,
+    claim_effective_automation_config_json TEXT NOT NULL,
+    phase                               TEXT NOT NULL DEFAULT 'observed',
+    outcome                             TEXT,
+    stop_reason                         TEXT,
+    workspace_evidence_json             TEXT,
+    observed_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    action_claimed_at                   DATETIME,
+    action_active_at                    DATETIME,
+    gate_pending_at                     DATETIME,
+    gate_active_at                      DATETIME,
+    verification_pending_at             DATETIME,
+    verification_active_at              DATETIME,
+    paused_at                           DATETIME,
+    terminal_at                         DATETIME,
+    deletion_claimed_at                 DATETIME,
+    created_at                          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at                          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (automation_progression_run_id, ordinal),
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (worktree_bundle_id) REFERENCES worktree_bundles(id) ON DELETE RESTRICT,
+    FOREIGN KEY (owner_ticket_id) REFERENCES tickets(id) ON DELETE RESTRICT,
+    FOREIGN KEY (automation_progression_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (triggering_review_execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (triggering_review_run_id) REFERENCES review_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (action_envelope_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (action_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (gate_batch_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (gate_source_batch_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (gate_evaluation_id) REFERENCES check_gate_evaluations(id) ON DELETE RESTRICT,
+    FOREIGN KEY (resulting_review_execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE RESTRICT,
+    FOREIGN KEY (resulting_review_run_id) REFERENCES review_runs(id) ON DELETE RESTRICT,
+    CHECK (ordinal >= 1),
+    CHECK (triggering_blocking_count >= 0),
+    CHECK (resulting_blocking_count IS NULL OR resulting_blocking_count >= 0),
+    CHECK (COALESCE((
+      json_valid(claim_effective_automation_config_json)
+      AND json_type(claim_effective_automation_config_json) = 'object'
+      AND length(CAST(claim_effective_automation_config_json AS BLOB)) BETWEEN 2 AND 16384
+      AND json_type(claim_effective_automation_config_json, '$.depth') = 'text'
+      AND json_extract(claim_effective_automation_config_json, '$.depth') IN ('manual', 'auto_review', 'auto_commit', 'auto_push', 'auto_pr')
+      AND json_type(claim_effective_automation_config_json, '$.reviewFixEnabled') IN ('true', 'false')
+      AND json_type(claim_effective_automation_config_json, '$.pauseOnOpenQuestions') IN ('true', 'false')
+      AND json_type(claim_effective_automation_config_json, '$.reviewSeverity') = 'text'
+      AND json_extract(claim_effective_automation_config_json, '$.reviewSeverity') IN ('high', 'medium', 'low')
+      AND json_type(claim_effective_automation_config_json, '$.reviewMaxIterations') = 'integer'
+      AND json_extract(claim_effective_automation_config_json, '$.reviewMaxIterations') BETWEEN 1 AND 10
+    ), 0)),
+    CHECK (workspace_evidence_json IS NULL OR (
+      json_valid(workspace_evidence_json)
+      AND json_type(workspace_evidence_json) = 'object'
+      AND length(CAST(workspace_evidence_json AS BLOB)) BETWEEN 2 AND 65536
+    )),
+    CHECK (phase IN (
+      'observed', 'action_claimed', 'action_active', 'gate_pending', 'gate_active',
+      'verification_pending', 'verification_active', 'paused', 'terminal'
+    )),
+    CHECK (outcome IS NULL OR outcome IN (
+      'repaired', 'continuing', 'unchanged', 'exhausted', 'failed', 'cancelled',
+      'interrupted', 'paused'
+    )),
+    CHECK (stop_reason IS NULL OR stop_reason IN (
+      'no_blocking_findings', 'max_iterations', 'automation_disabled', 'action_failed',
+      'gate_failed', 'verification_failed', 'no_progress', 'open_questions',
+      'configuration_changed', 'invalid_lineage', 'stale_evidence', 'manual_pause',
+      'cancelled', 'interrupted'
+    )),
+    CHECK ((phase = 'terminal' AND outcome IS NOT NULL AND terminal_at IS NOT NULL)
+      OR (phase = 'paused' AND outcome = 'paused' AND stop_reason IS NOT NULL AND paused_at IS NOT NULL)
+      OR (phase NOT IN ('paused', 'terminal') AND outcome IS NULL AND stop_reason IS NULL
+        AND terminal_at IS NULL)),
+    CHECK (resulting_review_execution_run_id IS NULL
+      OR resulting_review_execution_run_id <> triggering_review_execution_run_id),
+    CHECK (resulting_review_run_id IS NULL OR resulting_review_run_id <> triggering_review_run_id),
+    CHECK (gate_evaluation_id IS NULL OR gate_source_batch_run_id IS NOT NULL)
+  );
+
+  CREATE TABLE IF NOT EXISTS review_repair_iteration_decisions (
+    id                               TEXT PRIMARY KEY,
+    iteration_id                     TEXT NOT NULL,
+    operation_run_id                 TEXT,
+    sequence                         INTEGER NOT NULL,
+    decision_point                   TEXT NOT NULL,
+    effective_automation_config_json TEXT NOT NULL,
+    decision_code                    TEXT NOT NULL,
+    created_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (iteration_id, sequence),
+    FOREIGN KEY (iteration_id) REFERENCES review_repair_iterations(id) ON DELETE RESTRICT,
+    CHECK (sequence >= 1),
+    CHECK (decision_point IN (
+      'claim', 'action_completion', 'gate_admission', 'verification_scheduling',
+      'verification_completion', 'resume'
+    )),
+    CHECK (length(CAST(decision_code AS BLOB)) BETWEEN 1 AND 100),
+    CHECK (COALESCE((
+      json_valid(effective_automation_config_json)
+      AND json_type(effective_automation_config_json) = 'object'
+      AND length(CAST(effective_automation_config_json AS BLOB)) BETWEEN 2 AND 16384
+      AND json_type(effective_automation_config_json, '$.depth') = 'text'
+      AND json_extract(effective_automation_config_json, '$.depth') IN ('manual', 'auto_review', 'auto_commit', 'auto_push', 'auto_pr')
+      AND json_type(effective_automation_config_json, '$.reviewFixEnabled') IN ('true', 'false')
+      AND json_type(effective_automation_config_json, '$.pauseOnOpenQuestions') IN ('true', 'false')
+      AND json_type(effective_automation_config_json, '$.reviewSeverity') = 'text'
+      AND json_extract(effective_automation_config_json, '$.reviewSeverity') IN ('high', 'medium', 'low')
+      AND json_type(effective_automation_config_json, '$.reviewMaxIterations') = 'integer'
+      AND json_extract(effective_automation_config_json, '$.reviewMaxIterations') BETWEEN 1 AND 10
+    ), 0))
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_iteration_trigger
+    ON review_repair_iterations(triggering_review_execution_run_id);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_iteration_active_progression
+    ON review_repair_iterations(automation_progression_run_id)
+    WHERE phase <> 'terminal';
+  CREATE INDEX IF NOT EXISTS idx_review_repair_iterations_progression
+    ON review_repair_iterations(automation_progression_run_id, ordinal);
+  CREATE INDEX IF NOT EXISTS idx_review_repair_iterations_bundle_phase
+    ON review_repair_iterations(project_id, worktree_bundle_id, phase);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_iterations_action_envelope
+    ON review_repair_iterations(action_envelope_run_id) WHERE action_envelope_run_id IS NOT NULL;
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_iterations_action
+    ON review_repair_iterations(action_run_id) WHERE action_run_id IS NOT NULL;
+  DROP INDEX IF EXISTS idx_review_repair_iterations_gate;
+  CREATE INDEX IF NOT EXISTS idx_review_repair_iterations_gate
+    ON review_repair_iterations(gate_batch_run_id) WHERE gate_batch_run_id IS NOT NULL;
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_iterations_verification
+    ON review_repair_iterations(resulting_review_execution_run_id)
+    WHERE resulting_review_execution_run_id IS NOT NULL;
+  CREATE INDEX IF NOT EXISTS idx_review_repair_decisions_iteration
+    ON review_repair_iteration_decisions(iteration_id, sequence);
+
+  UPDATE review_repair_iterations
+  SET workspace_evidence_json = (
+    SELECT json_object(
+      'policyFingerprint', evaluation.effective_policy_fingerprint,
+      'selectedBatchRunId', review_repair_iterations.gate_batch_run_id,
+      'finalSourceBatchRunId', evaluation.source_batch_run_id,
+      'gateEvaluationId', evaluation.id,
+      'workspaceIdentity', json_extract(evaluation.snapshot_json, '$.workspaceIdentity')
+    )
+    FROM check_gate_evaluations evaluation
+    WHERE evaluation.id = review_repair_iterations.gate_evaluation_id
+      AND json_type(evaluation.snapshot_json, '$.workspaceIdentity') = 'object'
+  )
+  WHERE workspace_evidence_json IS NULL AND gate_evaluation_id IS NOT NULL
+    AND EXISTS (
+      SELECT 1 FROM check_gate_evaluations evaluation
+      WHERE evaluation.id = review_repair_iterations.gate_evaluation_id
+        AND json_type(evaluation.snapshot_json, '$.workspaceIdentity') = 'object'
+    );
+
+  DROP TRIGGER IF EXISTS validate_review_repair_iteration_insert;
+  CREATE TRIGGER validate_review_repair_iteration_insert
+  BEFORE INSERT ON review_repair_iterations
+  WHEN NEW.phase <> 'observed'
+    OR NEW.action_envelope_run_id IS NOT NULL
+    OR NEW.action_run_id IS NOT NULL
+    OR NEW.gate_batch_run_id IS NOT NULL
+    OR NEW.gate_source_batch_run_id IS NOT NULL
+    OR NEW.gate_evaluation_id IS NOT NULL
+    OR NEW.resulting_review_execution_run_id IS NOT NULL
+    OR NEW.resulting_review_run_id IS NOT NULL
+    OR NEW.resulting_blocking_count IS NOT NULL
+    OR NEW.outcome IS NOT NULL
+    OR NEW.stop_reason IS NOT NULL
+    OR NEW.action_claimed_at IS NOT NULL
+    OR NEW.action_active_at IS NOT NULL
+    OR NEW.gate_pending_at IS NOT NULL
+    OR NEW.gate_active_at IS NOT NULL
+    OR NEW.verification_pending_at IS NOT NULL
+    OR NEW.verification_active_at IS NOT NULL
+    OR NEW.paused_at IS NOT NULL
+    OR NEW.terminal_at IS NOT NULL
+    OR NOT EXISTS (
+    SELECT 1 FROM projects WHERE id = NEW.project_id AND deletion_started_at IS NULL
+  ) OR NOT EXISTS (
+    SELECT 1 FROM worktree_bundles
+    WHERE id = NEW.worktree_bundle_id AND project_id = NEW.project_id
+  ) OR NOT EXISTS (
+    SELECT 1 FROM tickets
+    WHERE id = NEW.owner_ticket_id AND project_id = NEW.project_id
+      AND worktree_bundle_id = NEW.worktree_bundle_id
+  ) OR NOT EXISTS (
+    SELECT 1
+    FROM execution_runs progression
+    JOIN execution_run_links bundle_link
+      ON bundle_link.execution_run_id = progression.id
+      AND bundle_link.project_id = progression.project_id
+      AND bundle_link.entity_type = 'bundle'
+      AND bundle_link.entity_id = NEW.worktree_bundle_id
+      AND bundle_link.relationship = 'primary'
+    WHERE progression.id = NEW.automation_progression_run_id
+      AND progression.project_id = NEW.project_id
+      AND progression.kind = 'automation_progression'
+  ) OR NOT EXISTS (
+    SELECT 1
+    FROM execution_runs review_execution
+    JOIN review_runs review ON review.id = NEW.triggering_review_run_id
+    JOIN execution_run_links result_link
+      ON result_link.execution_run_id = review_execution.id
+      AND result_link.project_id = review_execution.project_id
+      AND result_link.entity_type = 'review_run'
+      AND result_link.entity_id = review.id
+      AND result_link.relationship = 'result'
+    JOIN execution_run_links ticket_link
+      ON ticket_link.execution_run_id = review_execution.id
+      AND ticket_link.project_id = review_execution.project_id
+      AND ticket_link.entity_type = 'ticket'
+      AND ticket_link.entity_id = NEW.owner_ticket_id
+      AND ticket_link.relationship = 'primary'
+    JOIN execution_run_links bundle_link
+      ON bundle_link.execution_run_id = review_execution.id
+      AND bundle_link.project_id = review_execution.project_id
+      AND bundle_link.entity_type = 'bundle'
+      AND bundle_link.entity_id = NEW.worktree_bundle_id
+      AND bundle_link.relationship = 'context'
+    WHERE review_execution.id = NEW.triggering_review_execution_run_id
+      AND review_execution.project_id = NEW.project_id
+      AND review_execution.kind = 'review'
+      AND review_execution.status = 'completed'
+      AND review.ticket_id = NEW.owner_ticket_id
+      AND review.project_id = NEW.project_id
+      AND review.worktree_bundle_id = NEW.worktree_bundle_id
+      AND review.stage = 'review'
+      AND review.status = 'completed'
+      AND (
+        review_execution.parent_run_id = NEW.automation_progression_run_id
+        OR EXISTS (
+          SELECT 1 FROM execution_runs progression
+          WHERE progression.id = NEW.automation_progression_run_id
+            AND progression.project_id = NEW.project_id
+            AND progression.parent_run_id = review_execution.id
+        )
+      )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair iteration ownership or triggering Review lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_iteration_config_insert
+  BEFORE INSERT ON review_repair_iterations
+  WHEN COALESCE((
+    json_valid(NEW.claim_effective_automation_config_json)
+    AND json_type(NEW.claim_effective_automation_config_json) = 'object'
+    AND json_type(NEW.claim_effective_automation_config_json, '$.depth') = 'text'
+    AND json_extract(NEW.claim_effective_automation_config_json, '$.depth') IN ('manual', 'auto_review', 'auto_commit', 'auto_push', 'auto_pr')
+    AND json_type(NEW.claim_effective_automation_config_json, '$.reviewFixEnabled') IN ('true', 'false')
+    AND json_type(NEW.claim_effective_automation_config_json, '$.pauseOnOpenQuestions') IN ('true', 'false')
+    AND json_type(NEW.claim_effective_automation_config_json, '$.reviewSeverity') = 'text'
+    AND json_extract(NEW.claim_effective_automation_config_json, '$.reviewSeverity') IN ('high', 'medium', 'low')
+    AND json_type(NEW.claim_effective_automation_config_json, '$.reviewMaxIterations') = 'integer'
+    AND json_extract(NEW.claim_effective_automation_config_json, '$.reviewMaxIterations') BETWEEN 1 AND 10
+  ), 0) = 0
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Review repair iteration automation configuration');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_review_repair_iteration_claim
+  BEFORE UPDATE OF id, project_id, worktree_bundle_id, owner_ticket_id,
+    automation_progression_run_id, ordinal, triggering_review_execution_run_id,
+    triggering_review_run_id, triggering_blocking_count,
+    claim_effective_automation_config_json, observed_at, created_at
+    ON review_repair_iterations
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair iteration claim is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_iteration_deletion_claim
+  BEFORE UPDATE OF deletion_claimed_at ON review_repair_iterations
+  WHEN OLD.deletion_claimed_at IS NOT NULL
+    OR NEW.deletion_claimed_at IS NULL
+    OR OLD.phase <> 'terminal'
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Review repair iteration deletion claim');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_action_envelope_update
+  BEFORE UPDATE OF action_envelope_run_id ON review_repair_iterations
+  WHEN (OLD.action_envelope_run_id IS NOT NULL AND NEW.action_envelope_run_id IS NULL) OR (
+    NEW.action_envelope_run_id IS NOT NULL AND (
+    (OLD.action_envelope_run_id IS NOT NULL AND OLD.action_envelope_run_id <> NEW.action_envelope_run_id
+      AND OLD.action_run_id IS NOT NULL) OR
+    NOT EXISTS (
+      SELECT 1 FROM execution_runs action
+      JOIN execution_run_links bundle_link
+        ON bundle_link.execution_run_id = action.id AND bundle_link.project_id = action.project_id
+        AND bundle_link.entity_type = 'bundle' AND bundle_link.entity_id = NEW.worktree_bundle_id
+        AND bundle_link.relationship = 'primary'
+      WHERE action.id = NEW.action_envelope_run_id AND action.project_id = NEW.project_id
+        AND action.kind = 'automation_review_fix'
+        AND action.parent_run_id = NEW.automation_progression_run_id
+    ) OR (OLD.action_envelope_run_id IS NOT NULL AND NOT EXISTS (
+      SELECT 1 FROM execution_runs replacement JOIN execution_runs prior
+        ON prior.id = OLD.action_envelope_run_id
+      WHERE replacement.id = NEW.action_envelope_run_id
+        AND replacement.retry_of_run_id = prior.id
+        AND prior.status IN ('failed', 'cancelled', 'interrupted')
+    ))
+  )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair action envelope lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_action_update
+  BEFORE UPDATE OF action_run_id ON review_repair_iterations
+  WHEN (OLD.action_run_id IS NOT NULL AND NEW.action_run_id IS NULL) OR (
+    NEW.action_run_id IS NOT NULL AND (
+    (OLD.action_run_id IS NOT NULL AND OLD.action_run_id <> NEW.action_run_id
+      AND (OLD.gate_batch_run_id IS NOT NULL OR OLD.resulting_review_execution_run_id IS NOT NULL)) OR
+    NOT EXISTS (
+      SELECT 1 FROM execution_runs action
+      JOIN execution_run_links ticket_link
+        ON ticket_link.execution_run_id = action.id AND ticket_link.project_id = action.project_id
+        AND ticket_link.entity_type = 'ticket' AND ticket_link.entity_id = NEW.owner_ticket_id
+        AND ticket_link.relationship = 'primary'
+      JOIN execution_run_links bundle_link
+        ON bundle_link.execution_run_id = action.id AND bundle_link.project_id = action.project_id
+        AND bundle_link.entity_type = 'bundle' AND bundle_link.entity_id = NEW.worktree_bundle_id
+        AND bundle_link.relationship = 'context'
+      WHERE action.id = NEW.action_run_id AND action.project_id = NEW.project_id
+        AND action.kind IN ('build', 'build_follow_up')
+        AND action.parent_run_id = NEW.action_envelope_run_id
+    ) OR (OLD.action_run_id IS NOT NULL AND NOT EXISTS (
+      SELECT 1 FROM execution_runs replacement JOIN execution_runs prior
+        ON prior.id = OLD.action_run_id
+      WHERE replacement.id = NEW.action_run_id
+        AND replacement.retry_of_run_id = prior.id
+        AND prior.status IN ('failed', 'cancelled', 'interrupted')
+    ))
+  )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair action lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_gate_update
+  BEFORE UPDATE OF gate_batch_run_id ON review_repair_iterations
+  WHEN (OLD.gate_batch_run_id IS NOT NULL AND NEW.gate_batch_run_id IS NULL
+    AND NOT (NEW.phase = 'gate_pending' AND NEW.gate_source_batch_run_id IS NULL
+      AND NEW.gate_evaluation_id IS NULL AND NEW.resulting_review_execution_run_id IS NULL)) OR (
+    NEW.gate_batch_run_id IS NOT NULL AND (
+    (OLD.gate_batch_run_id IS NOT NULL AND OLD.gate_batch_run_id <> NEW.gate_batch_run_id
+      AND (OLD.gate_evaluation_id IS NOT NULL OR OLD.resulting_review_execution_run_id IS NOT NULL)) OR
+    NOT EXISTS (
+      SELECT 1 FROM execution_runs batch
+      JOIN check_batch_details details ON details.execution_run_id = batch.id
+      WHERE batch.id = NEW.gate_batch_run_id AND batch.project_id = NEW.project_id
+        AND batch.kind = 'check_batch' AND details.target_kind = 'bundle'
+        AND details.target_bundle_id = NEW.worktree_bundle_id
+        AND details.automation_boundary_purpose = 'automation_review'
+        AND batch.initiated_by = 'automation'
+        AND (OLD.gate_batch_run_id IS NOT NULL
+          OR batch.parent_run_id = NEW.automation_progression_run_id)
+    ) OR (OLD.gate_batch_run_id IS NOT NULL AND OLD.gate_batch_run_id <> NEW.gate_batch_run_id
+      AND NOT EXISTS (
+        SELECT 1 FROM check_batch_details
+        WHERE execution_run_id = NEW.gate_batch_run_id
+          AND rerun_of_batch_run_id = OLD.gate_batch_run_id
+      ))
+  ))
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair gate batch lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_gate_evaluation_update
+  BEFORE UPDATE OF gate_source_batch_run_id, gate_evaluation_id ON review_repair_iterations
+  WHEN (OLD.gate_evaluation_id IS NOT NULL AND (
+    NEW.gate_evaluation_id IS NULL OR NEW.gate_source_batch_run_id IS NULL
+  ) AND NOT (NEW.phase = 'gate_pending' AND NEW.gate_batch_run_id IS NULL
+    AND NEW.gate_evaluation_id IS NULL AND NEW.gate_source_batch_run_id IS NULL
+    AND NEW.resulting_review_execution_run_id IS NULL)) OR (NEW.gate_evaluation_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM check_gate_evaluations evaluation
+    WHERE evaluation.id = NEW.gate_evaluation_id
+      AND evaluation.project_id = NEW.project_id
+      AND evaluation.target_kind = 'bundle'
+      AND evaluation.target_bundle_id = NEW.worktree_bundle_id
+      AND evaluation.automation_progression_run_id = NEW.automation_progression_run_id
+      AND evaluation.boundary_kind = 'automation_review'
+      AND evaluation.source_batch_run_id = NEW.gate_source_batch_run_id
+      AND evaluation.attempts_sealed = 1
+      AND (NEW.gate_source_batch_run_id = NEW.gate_batch_run_id OR EXISTS (
+        SELECT 1 FROM check_batch_details source
+        WHERE source.execution_run_id = NEW.gate_source_batch_run_id
+          AND source.rerun_of_batch_run_id = NEW.gate_batch_run_id
+      ))
+  ))
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair gate evaluation lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_verification_update
+  BEFORE UPDATE OF resulting_review_execution_run_id ON review_repair_iterations
+  WHEN (OLD.resulting_review_execution_run_id IS NOT NULL AND NEW.resulting_review_execution_run_id IS NULL
+    AND NOT (
+      OLD.phase = 'paused' AND OLD.outcome = 'paused' AND OLD.stop_reason = 'stale_evidence'
+      AND NEW.phase = 'gate_pending' AND NEW.gate_batch_run_id IS NULL
+      AND NEW.gate_source_batch_run_id IS NULL AND NEW.gate_evaluation_id IS NULL
+      AND NEW.workspace_evidence_json IS NULL AND NEW.resulting_review_run_id IS NULL
+      AND NEW.resulting_blocking_count IS NULL
+      AND NEW.gate_active_at IS NULL AND NEW.verification_pending_at IS NULL
+      AND NEW.verification_active_at IS NULL
+    )) OR (
+    NEW.resulting_review_execution_run_id IS NOT NULL AND (
+    (OLD.resulting_review_execution_run_id IS NOT NULL
+      AND OLD.resulting_review_execution_run_id <> NEW.resulting_review_execution_run_id
+      AND OLD.resulting_review_run_id IS NOT NULL
+      AND NOT (NEW.resulting_review_run_id IS NULL AND EXISTS (
+        SELECT 1 FROM review_runs prior_result
+        WHERE prior_result.id = OLD.resulting_review_run_id
+          AND prior_result.status IN ('running', 'parse_failed', 'error', 'stopped')
+      ))) OR
+    NEW.resulting_review_execution_run_id = NEW.triggering_review_execution_run_id OR NOT EXISTS (
+      SELECT 1 FROM execution_runs verification
+      JOIN execution_run_links ticket_link
+        ON ticket_link.execution_run_id = verification.id AND ticket_link.project_id = verification.project_id
+        AND ticket_link.entity_type = 'ticket' AND ticket_link.entity_id = NEW.owner_ticket_id
+        AND ticket_link.relationship = 'primary'
+      JOIN execution_run_links bundle_link
+        ON bundle_link.execution_run_id = verification.id AND bundle_link.project_id = verification.project_id
+        AND bundle_link.entity_type = 'bundle' AND bundle_link.entity_id = NEW.worktree_bundle_id
+        AND bundle_link.relationship = 'context'
+      WHERE verification.id = NEW.resulting_review_execution_run_id
+        AND verification.project_id = NEW.project_id AND verification.kind = 'review'
+        AND verification.parent_run_id = NEW.automation_progression_run_id
+    ) OR (OLD.resulting_review_execution_run_id IS NOT NULL AND NOT EXISTS (
+      SELECT 1 FROM execution_runs replacement JOIN execution_runs prior
+        ON prior.id = OLD.resulting_review_execution_run_id
+      WHERE replacement.id = NEW.resulting_review_execution_run_id
+        AND replacement.retry_of_run_id = prior.id
+        AND prior.status IN ('failed', 'cancelled', 'interrupted')
+    ))
+  )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair verification lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_result_update
+  BEFORE UPDATE OF resulting_review_run_id ON review_repair_iterations
+  WHEN (OLD.resulting_review_run_id IS NOT NULL AND NEW.resulting_review_run_id IS NULL
+    AND NOT (OLD.resulting_review_execution_run_id <> NEW.resulting_review_execution_run_id
+      AND EXISTS (
+        SELECT 1 FROM review_runs prior_result
+        WHERE prior_result.id = OLD.resulting_review_run_id
+          AND prior_result.status IN ('running', 'parse_failed', 'error', 'stopped')
+      ))) OR (
+    NEW.resulting_review_run_id IS NOT NULL AND (
+    NEW.resulting_review_run_id = NEW.triggering_review_run_id OR NOT EXISTS (
+      SELECT 1 FROM review_runs review
+      JOIN execution_run_links result_link
+        ON result_link.entity_type = 'review_run' AND result_link.entity_id = review.id
+        AND result_link.relationship = 'result'
+      WHERE review.id = NEW.resulting_review_run_id
+        AND result_link.execution_run_id = NEW.resulting_review_execution_run_id
+        AND result_link.project_id = NEW.project_id
+        AND review.ticket_id = NEW.owner_ticket_id AND review.project_id = NEW.project_id
+        AND review.worktree_bundle_id = NEW.worktree_bundle_id AND review.stage = 'review'
+        AND review.status IN ('running', 'completed')
+        AND EXISTS (
+          SELECT 1 FROM execution_runs execution
+          WHERE execution.id = NEW.resulting_review_execution_run_id
+            AND execution.project_id = NEW.project_id
+            AND execution.status IN ('queued', 'running', 'completed')
+        )
+    )
+  ))
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid review repair resulting Review lineage');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_terminal_update
+  BEFORE UPDATE OF phase ON review_repair_iterations
+  WHEN NEW.phase = 'terminal' AND NEW.outcome IN ('repaired', 'continuing', 'unchanged', 'exhausted')
+    AND (
+      NEW.resulting_review_execution_run_id IS NULL
+      OR NEW.resulting_review_run_id IS NULL
+      OR NEW.resulting_blocking_count IS NULL
+      OR NOT EXISTS (
+        SELECT 1 FROM execution_runs execution
+        JOIN review_runs review ON review.id = NEW.resulting_review_run_id
+        JOIN execution_run_links result_link
+          ON result_link.execution_run_id = execution.id
+          AND result_link.project_id = execution.project_id
+          AND result_link.entity_type = 'review_run'
+          AND result_link.entity_id = review.id
+          AND result_link.relationship = 'result'
+        WHERE execution.id = NEW.resulting_review_execution_run_id
+          AND execution.project_id = NEW.project_id
+          AND execution.kind = 'review' AND execution.status = 'completed'
+          AND review.status = 'completed'
+      )
+    )
+  BEGIN
+    SELECT RAISE(ABORT, 'Completed Review repair outcomes require completed verification evidence');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_phase_update
+  BEFORE UPDATE OF phase ON review_repair_iterations
+  WHEN NEW.phase <> OLD.phase
+    AND NEW.phase NOT IN ('paused', 'terminal')
+    AND NOT (
+      (OLD.phase = 'paused' AND NEW.phase IN (
+        'observed', 'action_claimed', 'action_active', 'gate_pending', 'gate_active',
+        'verification_pending', 'verification_active'
+      ))
+      OR (OLD.phase = 'observed' AND NEW.phase = 'action_claimed')
+      OR (OLD.phase = 'action_claimed' AND NEW.phase = 'action_active')
+      OR (OLD.phase = 'action_active' AND NEW.phase = 'gate_pending')
+      OR (OLD.phase = 'gate_pending' AND NEW.phase = 'gate_active')
+      OR (OLD.phase = 'gate_active' AND NEW.phase = 'gate_pending'
+        AND NEW.gate_batch_run_id IS NULL AND NEW.gate_source_batch_run_id IS NULL
+        AND NEW.gate_evaluation_id IS NULL AND NEW.resulting_review_execution_run_id IS NULL)
+      OR (OLD.phase = 'gate_active' AND NEW.phase = 'verification_pending')
+      OR (OLD.phase = 'verification_pending' AND NEW.phase = 'verification_active')
+    )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Review repair iteration phase transition');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_review_repair_decision
+  BEFORE UPDATE ON review_repair_iteration_decisions
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair iteration decisions are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_decision_insert
+  BEFORE INSERT ON review_repair_iteration_decisions
+  WHEN NOT EXISTS (
+    SELECT 1 FROM review_repair_iterations iteration
+    JOIN projects project ON project.id = iteration.project_id
+    WHERE iteration.id = NEW.iteration_id AND project.deletion_started_at IS NULL
+  ) OR NEW.sequence <> COALESCE((
+    SELECT MAX(sequence) + 1 FROM review_repair_iteration_decisions
+    WHERE iteration_id = NEW.iteration_id
+  ), 1)
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Review repair iteration decision sequence');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_decision_config_insert
+  BEFORE INSERT ON review_repair_iteration_decisions
+  WHEN COALESCE((
+    json_valid(NEW.effective_automation_config_json)
+    AND json_type(NEW.effective_automation_config_json) = 'object'
+    AND json_type(NEW.effective_automation_config_json, '$.depth') = 'text'
+    AND json_extract(NEW.effective_automation_config_json, '$.depth') IN ('manual', 'auto_review', 'auto_commit', 'auto_push', 'auto_pr')
+    AND json_type(NEW.effective_automation_config_json, '$.reviewFixEnabled') IN ('true', 'false')
+    AND json_type(NEW.effective_automation_config_json, '$.pauseOnOpenQuestions') IN ('true', 'false')
+    AND json_type(NEW.effective_automation_config_json, '$.reviewSeverity') = 'text'
+    AND json_extract(NEW.effective_automation_config_json, '$.reviewSeverity') IN ('high', 'medium', 'low')
+    AND json_type(NEW.effective_automation_config_json, '$.reviewMaxIterations') = 'integer'
+    AND json_extract(NEW.effective_automation_config_json, '$.reviewMaxIterations') BETWEEN 1 AND 10
+  ), 0) = 0
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Review repair decision automation configuration');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS prevent_review_repair_iteration_delete
+  BEFORE DELETE ON review_repair_iterations
+  WHEN OLD.deletion_claimed_at IS NULL
+    AND EXISTS (SELECT 1 FROM projects WHERE id = OLD.project_id AND deletion_started_at IS NULL)
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair iterations are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS prevent_review_repair_decision_delete
+  BEFORE DELETE ON review_repair_iteration_decisions
+  WHEN EXISTS (
+    SELECT 1 FROM review_repair_iterations iteration
+    JOIN projects project ON project.id = iteration.project_id
+    WHERE iteration.id = OLD.iteration_id AND iteration.deletion_claimed_at IS NULL
+      AND project.deletion_started_at IS NULL
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair iteration decisions are immutable');
+  END;
+`);
+ensureColumn('review_repair_iteration_decisions', 'operation_run_id', 'TEXT');
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_repair_decisions_operation
+    ON review_repair_iteration_decisions(iteration_id, decision_point, operation_run_id)
+    WHERE operation_run_id IS NOT NULL;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS automation_stage_details (
     execution_run_id  TEXT PRIMARY KEY,