@straiffi/archon 1.10.9 → 1.10.12

package/dist/server/db.js

@@ -1,5 +1,5 @@
 import Database from 'better-sqlite3';
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { parseCheckDefinitionsJsonStrict, parseLegacyTestCommandsJsonStrict, projectCheckDefinitionsToTestCommands, } from './lib/checkDefinitions.js';
 import { ensureParentDirectory, resolveArchonDbPath } from './lib/runtimePaths.js';
 import { TRANSCRIPT_RUN_TEXT_LIMIT_BYTES, truncateUtf8 } from './lib/transcriptRuns.js';
@@ -183,6 +183,46 @@ ensureColumn('projects', 'spec_aware_code_review_enabled', 'INTEGER NOT NULL DEF
 ensureColumn('projects', 'deletion_started_at', 'DATETIME');
 ensureColumn('projects', 'deletion_claim_id', 'TEXT');
 ensureColumn('projects', 'deletion_cleanup_started_at', 'DATETIME');
+ensureColumn('projects', 'run_services', 'TEXT');
+db.transaction(() => {
+    const projects = db.prepare('SELECT id, run_services FROM projects WHERE run_services IS NOT NULL').all();
+    const update = db.prepare('UPDATE projects SET run_services = ? WHERE id = ?');
+    for (const project of projects) {
+        let services;
+        try {
+            services = JSON.parse(project.run_services);
+        }
+        catch {
+            continue;
+        }
+        // Leave malformed legacy configuration intact rather than partially rewriting it.
+        if (!Array.isArray(services) || services.some(service => !service || typeof service !== 'object' || Array.isArray(service))) {
+            continue;
+        }
+        const entries = services;
+        const validId = (id) => typeof id === 'string' && id.trim().length > 0 && id === id.trim();
+        const reserved = new Set(entries.map(service => service.id).filter(validId));
+        const seen = new Set();
+        let changed = false;
+        for (const service of entries) {
+            if (validId(service.id) && !seen.has(service.id)) {
+                seen.add(service.id);
+                continue;
+            }
+            let id;
+            do {
+                id = randomUUID();
+            } while (reserved.has(id));
+            reserved.add(id);
+            seen.add(id);
+            service.id = id;
+            changed = true;
+        }
+        if (changed) {
+            update.run(JSON.stringify(entries), project.id);
+        }
+    }
+}).immediate();
 const backfillAgentModelMaps = () => {
     db.transaction(() => {
         db.exec(`
@@ -2655,6 +2695,15 @@ db.exec(`
     service_snapshot_json            TEXT NOT NULL,
     placement_json                   TEXT,
     interruption_scope               TEXT,
+    intended_status                  TEXT,
+    intended_event_type              TEXT,
+    intended_message                 TEXT,
+    cleanup_claim_id                 TEXT,
+    cleanup_claimed_at               DATETIME,
+    cleanup_attempts                 INTEGER NOT NULL DEFAULT 0,
+    cleanup_retry_at                 DATETIME,
+    cleanup_error_message            TEXT,
+    force_released_at                DATETIME,
     created_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     started_at                       DATETIME,
     completed_at                     DATETIME,
@@ -2672,7 +2721,11 @@ db.exec(`
     CHECK (environment_revision IS NULL OR environment_revision >= 1),
     CHECK (length(CAST(service_snapshot_json AS BLOB)) BETWEEN 2 AND 16384),
     CHECK (placement_json IS NULL OR length(CAST(placement_json AS BLOB)) BETWEEN 2 AND 16384),
-    CHECK (interruption_scope IS NULL OR interruption_scope IN ('local_processes', 'whole_environment'))
+    CHECK (interruption_scope IS NULL OR interruption_scope IN ('local_processes', 'whole_environment')),
+    CHECK (intended_status IS NULL OR intended_status IN ('completed', 'failed', 'cancelled', 'interrupted')),
+    CHECK ((cleanup_claim_id IS NULL) = (cleanup_claimed_at IS NULL)),
+    CHECK (cleanup_attempts >= 0),
+    CHECK (cleanup_error_message IS NULL OR length(cleanup_error_message) <= 4000)
   );
 
   CREATE UNIQUE INDEX IF NOT EXISTS idx_active_service_run_context
@@ -2682,6 +2735,15 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_service_run_profile
     ON service_run_details(project_id, execution_profile_revision_id, created_at);
 `);
+ensureColumn('service_run_details', 'intended_status', 'TEXT');
+ensureColumn('service_run_details', 'intended_event_type', 'TEXT');
+ensureColumn('service_run_details', 'intended_message', 'TEXT');
+ensureColumn('service_run_details', 'cleanup_claim_id', 'TEXT');
+ensureColumn('service_run_details', 'cleanup_claimed_at', 'DATETIME');
+ensureColumn('service_run_details', 'cleanup_attempts', 'INTEGER NOT NULL DEFAULT 0');
+ensureColumn('service_run_details', 'cleanup_retry_at', 'DATETIME');
+ensureColumn('service_run_details', 'cleanup_error_message', 'TEXT');
+ensureColumn('service_run_details', 'force_released_at', 'DATETIME');
 const executionEnvironmentStates = "'queued', 'preparing', 'ready', 'running', 'stopped', 'retiring', 'cleanup_pending', 'retired', 'failed', 'unavailable'";
 db.exec(`
   CREATE TABLE IF NOT EXISTS execution_environments (
@@ -2892,6 +2954,195 @@ ensureColumn('execution_environments', 'operation_claimed_at', 'DATETIME');
 ensureColumn('execution_environment_run_bindings', 'execution_profile_fingerprint', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'authority_json', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'placement_json', 'TEXT');
+db.exec('DROP TRIGGER IF EXISTS protect_service_project_target');
+db.exec(`
+  CREATE VIEW IF NOT EXISTS active_project_service_authorities AS
+  SELECT run.id AS execution_run_id, run.project_id
+  FROM execution_runs run
+  WHERE run.kind = 'service' AND (
+    run.status NOT IN ('completed', 'failed', 'cancelled', 'interrupted')
+    OR EXISTS (SELECT 1 FROM service_run_details details
+      WHERE details.execution_run_id = run.id AND details.completed_at IS NULL)
+    OR EXISTS (SELECT 1 FROM execution_environment_run_bindings binding
+      WHERE binding.execution_run_id = run.id AND binding.relationship = 'execution'
+        AND binding.released_at IS NULL)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS admit_project_service_run
+  BEFORE INSERT ON execution_runs WHEN NEW.kind = 'service'
+  BEGIN
+    SELECT RAISE(ABORT, 'Project is being deleted') WHERE EXISTS (
+      SELECT 1 FROM projects WHERE id = NEW.project_id AND deletion_started_at IS NOT NULL);
+    SELECT RAISE(ABORT, 'Project already has active service authority') WHERE EXISTS (
+      SELECT 1 FROM active_project_service_authorities WHERE project_id = NEW.project_id);
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS admit_project_service_details
+  BEFORE INSERT ON service_run_details
+  BEGIN
+    SELECT RAISE(ABORT, 'New service authority must be unfinished') WHERE NEW.completed_at IS NOT NULL;
+    SELECT RAISE(ABORT, 'Service profile fingerprint does not match') WHERE NOT EXISTS (
+      SELECT 1 FROM execution_profile_revisions WHERE id = NEW.execution_profile_revision_id
+        AND project_id = NEW.project_id AND fingerprint = NEW.execution_profile_fingerprint);
+    SELECT RAISE(ABORT, 'Service details require an active service run') WHERE NOT EXISTS (
+      SELECT 1 FROM execution_runs WHERE id = NEW.execution_run_id AND project_id = NEW.project_id
+        AND kind = 'service' AND status NOT IN ('completed', 'failed', 'cancelled', 'interrupted'));
+    SELECT RAISE(ABORT, 'Project is being deleted') WHERE EXISTS (
+      SELECT 1 FROM projects WHERE id = NEW.project_id AND deletion_started_at IS NOT NULL);
+    SELECT RAISE(ABORT, 'Project already has active service authority') WHERE EXISTS (
+      SELECT 1 FROM active_project_service_authorities WHERE project_id = NEW.project_id
+        AND execution_run_id <> NEW.execution_run_id);
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_service_detail_identity
+  BEFORE UPDATE ON service_run_details
+  WHEN NEW.execution_run_id IS NOT OLD.execution_run_id OR NEW.project_id IS NOT OLD.project_id
+    OR NEW.context_key IS NOT OLD.context_key OR NEW.target_kind IS NOT OLD.target_kind
+    OR NEW.target_key IS NOT OLD.target_key OR NEW.target_workspace_path IS NOT OLD.target_workspace_path
+    OR NEW.execution_profile_revision_id IS NOT OLD.execution_profile_revision_id
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.service_snapshot_json IS NOT OLD.service_snapshot_json
+    OR (OLD.completed_at IS NOT NULL AND NEW.completed_at IS NOT OLD.completed_at)
+  BEGIN
+    SELECT RAISE(ABORT, 'Service run authority is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_run_identity
+  BEFORE UPDATE OF id, kind, project_id ON execution_runs
+  WHEN (OLD.kind = 'service' OR NEW.kind = 'service') AND (
+    NEW.id IS NOT OLD.id OR NEW.kind IS NOT OLD.kind OR NEW.project_id IS NOT OLD.project_id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Service run authority is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_run_reactivation
+  BEFORE UPDATE OF status ON execution_runs
+  WHEN OLD.kind = 'service' AND OLD.status IN ('completed', 'failed', 'cancelled', 'interrupted')
+    AND NEW.status NOT IN ('completed', 'failed', 'cancelled', 'interrupted')
+  BEGIN
+    SELECT RAISE(ABORT, 'Terminal service run cannot be reactivated');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS admit_service_execution_binding
+  BEFORE INSERT ON execution_environment_run_bindings
+  WHEN NEW.relationship = 'execution' AND NEW.released_at IS NULL AND EXISTS (
+    SELECT 1 FROM execution_runs WHERE id = NEW.execution_run_id AND kind = 'service')
+  BEGIN
+    SELECT RAISE(ABORT, 'Service binding requires unfinished authority') WHERE NOT EXISTS (
+      SELECT 1 FROM service_run_details details JOIN execution_runs run ON run.id = details.execution_run_id
+      JOIN projects project ON project.id = details.project_id
+      WHERE details.execution_run_id = NEW.execution_run_id AND details.project_id = NEW.project_id
+        AND details.completed_at IS NULL AND project.deletion_started_at IS NULL
+        AND run.status NOT IN ('completed', 'failed', 'cancelled', 'interrupted'));
+    SELECT RAISE(ABORT, 'Project already has active service authority') WHERE EXISTS (
+      SELECT 1 FROM active_project_service_authorities WHERE project_id = NEW.project_id
+        AND execution_run_id <> NEW.execution_run_id);
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_binding_reactivation
+  BEFORE UPDATE OF released_at ON execution_environment_run_bindings
+  WHEN OLD.relationship = 'execution' AND OLD.released_at IS NOT NULL AND NEW.released_at IS NULL
+    AND EXISTS (SELECT 1 FROM execution_runs WHERE id = OLD.execution_run_id AND kind = 'service')
+  BEGIN
+    SELECT RAISE(ABORT, 'Released service binding cannot be reactivated');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_binding_deletion
+  BEFORE DELETE ON execution_environment_run_bindings
+  WHEN OLD.relationship = 'execution' AND OLD.released_at IS NULL
+    AND EXISTS (SELECT 1 FROM execution_runs WHERE id = OLD.execution_run_id AND kind = 'service')
+  BEGIN
+    SELECT RAISE(ABORT, 'Service execution binding is unreleased');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_completion
+  BEFORE UPDATE OF completed_at ON service_run_details
+  WHEN NEW.completed_at IS NOT NULL AND EXISTS (
+    SELECT 1 FROM execution_environment_run_bindings WHERE execution_run_id = OLD.execution_run_id
+      AND relationship = 'execution' AND released_at IS NULL)
+  BEGIN
+    SELECT RAISE(ABORT, 'Service execution binding is unreleased');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS require_terminal_service_completion
+  BEFORE UPDATE OF completed_at ON service_run_details
+  WHEN NEW.completed_at IS NOT NULL AND EXISTS (
+    SELECT 1 FROM execution_runs WHERE id = OLD.execution_run_id
+      AND status NOT IN ('completed', 'failed', 'cancelled', 'interrupted'))
+  BEGIN
+    SELECT RAISE(ABORT, 'Service run must be terminal before completing details');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_detail_deletion
+  BEFORE DELETE ON service_run_details
+  WHEN EXISTS (SELECT 1 FROM active_project_service_authorities WHERE execution_run_id = OLD.execution_run_id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Service run authority is active');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_run_deletion
+  BEFORE DELETE ON execution_runs
+  WHEN EXISTS (SELECT 1 FROM active_project_service_authorities WHERE execution_run_id = OLD.id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Service run authority is active');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_ticket_deletion
+  BEFORE DELETE ON tickets
+  WHEN EXISTS (
+    SELECT 1 FROM active_project_service_authorities active
+    JOIN execution_runs run ON run.id = active.execution_run_id
+    WHERE run.source_kind = 'ticket' AND run.source_id = OLD.id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Ticket has active service authority');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_ticket_target
+  BEFORE UPDATE OF project_id, worktree_bundle_id ON tickets
+  WHEN (NEW.project_id IS NOT OLD.project_id OR NEW.worktree_bundle_id IS NOT OLD.worktree_bundle_id)
+    AND EXISTS (
+      SELECT 1 FROM active_project_service_authorities active
+      JOIN execution_runs run ON run.id = active.execution_run_id
+      WHERE run.source_kind = 'ticket' AND run.source_id = OLD.id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Ticket has active service authority');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_project_deletion_claim
+  BEFORE UPDATE OF deletion_started_at ON projects
+  WHEN NEW.deletion_started_at IS NOT NULL AND EXISTS (
+    SELECT 1 FROM active_project_service_authorities WHERE project_id = OLD.id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Project has active service authority');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_project_deletion
+  BEFORE DELETE ON projects
+  WHEN EXISTS (SELECT 1 FROM active_project_service_authorities WHERE project_id = OLD.id)
+  BEGIN
+    SELECT RAISE(ABORT, 'Project has active service authority');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_project_target
+  BEFORE UPDATE OF active_target_kind, active_target_bundle_id ON projects
+  WHEN EXISTS (
+      SELECT 1 FROM active_project_service_authorities active
+      JOIN execution_runs run ON run.id = active.execution_run_id
+      WHERE active.project_id = OLD.id AND (run.source_kind IS NULL OR run.source_kind <> 'ticket'))
+    OR OLD.deletion_started_at IS NOT NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'Cannot change project target while service authority or deletion is active');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS protect_service_project_repo_path
+  BEFORE UPDATE OF repo_path ON projects
+  WHEN NEW.repo_path IS NOT OLD.repo_path AND (
+    EXISTS (SELECT 1 FROM active_project_service_authorities WHERE project_id = OLD.id)
+    OR OLD.deletion_started_at IS NOT NULL)
+  BEGIN
+    SELECT RAISE(ABORT, 'Cannot change project repository while service authority or deletion is active');
+  END;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS execution_run_authorities (
     execution_run_id                 TEXT NOT NULL,
@@ -5176,6 +5427,67 @@ db.exec(`
     FOREIGN KEY (review_run_id) REFERENCES review_runs(id) ON DELETE CASCADE
   )
 `);
+ensureColumn('review_runs', 'output_provenance', `TEXT CHECK (output_provenance IS NULL OR output_provenance IN ('structured_primary', 'structured_transcript', 'subagent_aggregation', 'markdown_fallback', 'parse_failed'))`);
+ensureColumn('review_runs', 'evaluator_fingerprint', `TEXT CHECK (evaluator_fingerprint IS NULL OR (length(evaluator_fingerprint) = 64 AND evaluator_fingerprint NOT GLOB '*[^0-9a-f]*'))`);
+// Historical identity survives deletion of the source ticket; writes are validated below.
+ensureColumn('review_findings', 'predecessor_finding_id', 'TEXT');
+ensureColumn('review_findings', 'evaluator_fingerprint', `TEXT CHECK (evaluator_fingerprint IS NULL OR (length(evaluator_fingerprint) = 64 AND evaluator_fingerprint NOT GLOB '*[^0-9a-f]*'))`);
+ensureColumn('review_findings', 'output_provenance', `TEXT CHECK (output_provenance IS NULL OR output_provenance IN ('structured_primary', 'structured_transcript', 'subagent_aggregation', 'markdown_fallback', 'parse_failed'))`);
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_review_finding_predecessor
+    ON review_findings(review_run_id, predecessor_finding_id) WHERE predecessor_finding_id IS NOT NULL;
+  CREATE TRIGGER IF NOT EXISTS preserve_review_finding_predecessor
+    BEFORE UPDATE OF predecessor_finding_id ON review_findings
+    WHEN NEW.predecessor_finding_id IS NOT OLD.predecessor_finding_id
+    BEGIN
+      SELECT RAISE(ABORT, 'Review finding predecessor is immutable');
+    END;
+  CREATE TRIGGER IF NOT EXISTS preserve_review_finding_lineage_owner
+    BEFORE UPDATE OF review_run_id ON review_findings
+    WHEN NEW.review_run_id IS NOT OLD.review_run_id AND EXISTS (
+      SELECT 1 FROM review_findings WHERE predecessor_finding_id = OLD.id
+    )
+    BEGIN
+      SELECT RAISE(ABORT, 'Review finding lineage ownership is immutable');
+    END;
+  CREATE TRIGGER IF NOT EXISTS preserve_review_run_lineage_owner
+    BEFORE UPDATE OF ticket_id, project_id, worktree_bundle_id, status ON review_runs
+    WHEN (NEW.ticket_id IS NOT OLD.ticket_id OR NEW.project_id IS NOT OLD.project_id
+      OR NEW.worktree_bundle_id IS NOT OLD.worktree_bundle_id OR NEW.status IS NOT OLD.status)
+      AND EXISTS (
+        SELECT 1 FROM review_findings predecessor
+        JOIN review_findings successor ON successor.predecessor_finding_id = predecessor.id
+        WHERE predecessor.review_run_id = OLD.id
+          OR (successor.review_run_id = OLD.id AND (
+            NEW.ticket_id IS NOT OLD.ticket_id OR NEW.project_id IS NOT OLD.project_id
+            OR NEW.worktree_bundle_id IS NOT OLD.worktree_bundle_id
+          ))
+      )
+    BEGIN
+      SELECT RAISE(ABORT, 'Review run lineage ownership is immutable');
+    END;
+`);
+for (const operation of ['INSERT', 'UPDATE']) {
+    db.exec(`
+    DROP TRIGGER IF EXISTS validate_review_finding_predecessor_${operation.toLowerCase()};
+    CREATE TRIGGER validate_review_finding_predecessor_${operation.toLowerCase()}
+    BEFORE ${operation} ON review_findings
+    WHEN NEW.predecessor_finding_id IS NOT NULL
+    BEGIN
+      SELECT RAISE(ABORT, 'Invalid review finding predecessor') WHERE NOT EXISTS (
+        SELECT 1 FROM review_findings predecessor
+        JOIN review_runs prior ON prior.id = predecessor.review_run_id
+        JOIN review_runs current ON current.id = NEW.review_run_id
+        WHERE predecessor.id = NEW.predecessor_finding_id
+          AND prior.id <> current.id
+          AND prior.status = 'completed'
+          AND prior.project_id IS current.project_id
+          AND prior.worktree_bundle_id IS current.worktree_bundle_id
+          AND (current.worktree_bundle_id IS NOT NULL OR prior.ticket_id = current.ticket_id)
+      );
+    END;
+  `);
+}
 db.exec(`
   CREATE TABLE IF NOT EXISTS bundle_pull_requests (
     id                TEXT PRIMARY KEY,
@@ -5215,7 +5527,6 @@ db.exec(`
     automation_paused_code   TEXT,
     automation_paused_reason TEXT,
     automation_paused_at     DATETIME,
-    automation_delivery_ready_stage_run_id TEXT,
     created_at               DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     updated_at               DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     PRIMARY KEY (project_id, worktree_bundle_id),
@@ -5231,7 +5542,6 @@ ensureColumn('bundle_automation_state', 'automation_progression_run_id', 'TEXT')
 ensureColumn('bundle_automation_state', 'automation_paused_stage_run_id', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_paused_boundary_purpose', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_pause_reason_code', 'TEXT');
-ensureColumn('bundle_automation_state', 'automation_delivery_ready_stage_run_id', 'TEXT');
 db.exec('DROP TRIGGER IF EXISTS validate_review_repair_result_update');
 db.exec('DROP TRIGGER IF EXISTS validate_review_repair_gate_update');
 db.exec('DROP TRIGGER IF EXISTS validate_review_repair_gate_evaluation_update');
@@ -5693,9 +6003,19 @@ db.exec(`
     SELECT RAISE(ABORT, 'Invalid review repair verification lineage');
   END;
 
-  CREATE TRIGGER IF NOT EXISTS validate_review_repair_result_update
+  DROP TRIGGER IF EXISTS validate_review_repair_result_update;
+  CREATE TRIGGER validate_review_repair_result_update
   BEFORE UPDATE OF resulting_review_run_id ON review_repair_iterations
   WHEN (OLD.resulting_review_run_id IS NOT NULL AND NEW.resulting_review_run_id IS NULL
+    AND NOT (
+      OLD.phase = 'paused' AND OLD.outcome IS 'paused' AND OLD.stop_reason IS 'stale_evidence'
+      AND NEW.phase = 'gate_pending' AND NEW.outcome IS NULL AND NEW.stop_reason IS NULL
+      AND NEW.resulting_review_execution_run_id IS NULL AND NEW.resulting_blocking_count IS NULL
+      AND NEW.gate_batch_run_id IS NULL AND NEW.gate_source_batch_run_id IS NULL
+      AND NEW.gate_evaluation_id IS NULL AND NEW.workspace_evidence_json IS NULL
+      AND NEW.gate_active_at IS NULL AND NEW.verification_pending_at IS NULL
+      AND NEW.verification_active_at IS NULL
+    )
     AND NOT (OLD.resulting_review_execution_run_id <> NEW.resulting_review_execution_run_id
       AND EXISTS (
         SELECT 1 FROM review_runs prior_result
@@ -5941,6 +6261,49 @@ db.exec('CREATE INDEX IF NOT EXISTS idx_chat_sessions_project_updated_at ON chat
 db.exec('CREATE INDEX IF NOT EXISTS idx_chat_messages_session_created_at ON chat_messages(chat_session_id, created_at)');
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_ticket_stage_changes_ticket_stage ON ticket_stage_changes(ticket_id, stage)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_ticket_stage_changes_bundle_stage_success ON ticket_stage_changes(project_id, worktree_bundle_id, stage, success_revision)');
+ensureColumn('review_repair_iterations', 'progress_assessment_json', `TEXT CHECK (progress_assessment_json IS NULL OR CASE WHEN json_valid(progress_assessment_json) THEN json_type(progress_assessment_json) = 'object' AND length(CAST(progress_assessment_json AS BLOB)) BETWEEN 2 AND 16384 ELSE 0 END)`);
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_assessment_insert
+  BEFORE INSERT ON review_repair_iterations
+  WHEN NEW.progress_assessment_json IS NOT NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair assessment requires existing verification evidence');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_review_repair_assessment_update
+  BEFORE UPDATE ON review_repair_iterations
+  WHEN (OLD.progress_assessment_json IS NULL AND NEW.progress_assessment_json IS NOT NULL AND (
+    OLD.phase <> 'verification_active' OR NEW.phase <> 'verification_active'
+    OR OLD.resulting_review_execution_run_id IS NULL OR OLD.resulting_review_run_id IS NULL
+    OR NEW.resulting_review_execution_run_id IS NOT OLD.resulting_review_execution_run_id
+    OR NEW.resulting_review_run_id IS NOT OLD.resulting_review_run_id
+  )) OR (OLD.progress_assessment_json IS NOT NULL AND (
+    NEW.progress_assessment_json IS NOT OLD.progress_assessment_json
+    OR NEW.resulting_review_execution_run_id IS NOT OLD.resulting_review_execution_run_id
+    OR NEW.resulting_review_run_id IS NOT OLD.resulting_review_run_id
+  ) AND NOT (
+    OLD.phase = 'paused' AND OLD.outcome IS 'paused' AND OLD.stop_reason IS 'stale_evidence'
+    AND NEW.phase = 'gate_pending' AND NEW.outcome IS NULL AND NEW.stop_reason IS NULL
+    AND NEW.progress_assessment_json IS NULL
+    AND NEW.resulting_review_execution_run_id IS NULL AND NEW.resulting_review_run_id IS NULL
+    AND NEW.resulting_blocking_count IS NULL AND NEW.gate_batch_run_id IS NULL
+    AND NEW.gate_source_batch_run_id IS NULL AND NEW.gate_evaluation_id IS NULL
+    AND NEW.workspace_evidence_json IS NULL AND NEW.gate_active_at IS NULL
+    AND NEW.verification_pending_at IS NULL AND NEW.verification_active_at IS NULL
+  ))
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid or immutable Review repair progress assessment');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS prevent_review_repair_no_progress_resume
+  BEFORE UPDATE ON review_repair_iterations
+  WHEN OLD.phase = 'paused' AND OLD.stop_reason = 'no_progress'
+    AND NEW.phase <> 'terminal'
+    AND (NEW.phase <> 'paused' OR NEW.stop_reason IS NOT 'no_progress')
+  BEGIN
+    SELECT RAISE(ABORT, 'Review repair no_progress requires an explicit successor iteration');
+  END;
+`);
 db.exec('CREATE INDEX IF NOT EXISTS idx_review_runs_ticket_created_at ON review_runs(ticket_id, created_at)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_review_runs_bundle_created_at ON review_runs(project_id, worktree_bundle_id, created_at)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_review_findings_review_run_ordinal ON review_findings(review_run_id, ordinal)');