@straiffi/archon 1.7.10 → 1.8.1

package/dist/server/db.js

@@ -59,6 +59,7 @@ db.exec(`
     check_definitions TEXT,
     required_check_definition_ids TEXT NOT NULL DEFAULT '[]',
     pre_review_check_definition_ids TEXT NOT NULL DEFAULT '[]',
+    post_build_check_definition_ids TEXT NOT NULL DEFAULT '[]',
     test_commands TEXT,
     run_ide      TEXT,
     preview_service_name TEXT,
@@ -132,12 +133,14 @@ ensureColumn('worktree_bundles', 'automation_depth', 'TEXT');
 ensureColumn('worktree_bundles', 'automation_review_fix_enabled', 'INTEGER');
 ensureColumn('worktree_bundles', 'automation_pause_on_open_questions', 'INTEGER');
 ensureColumn('worktree_bundles', 'required_check_policy_override', 'TEXT');
+db.exec('UPDATE worktree_bundles SET required_check_policy_override = NULL WHERE required_check_policy_override IS NOT NULL');
 ensureColumn('projects', 'worktree_sync', 'TEXT');
 ensureColumn('projects', 'active_target_kind', "TEXT NOT NULL DEFAULT 'repo_root'");
 ensureColumn('projects', 'active_target_bundle_id', 'TEXT');
 ensureColumn('projects', 'check_definitions', 'TEXT');
 ensureColumn('projects', 'required_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
 ensureColumn('projects', 'pre_review_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
+ensureColumn('projects', 'post_build_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
 ensureColumn('projects', 'test_commands', 'TEXT');
 ensureColumn('projects', 'helper_model', 'TEXT');
 ensureColumn('projects', 'helper_variant', 'TEXT');
@@ -824,6 +827,7 @@ db.exec(`
     likely_files_json TEXT,
     tickets_json    TEXT,
     dependencies_json TEXT,
+    resource_urls_json TEXT,
     mermaid         TEXT,
     mockup          TEXT,
     created_at      DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -833,6 +837,7 @@ db.exec(`
 ensureColumn('spec_snapshots', 'plan_text', 'TEXT');
 ensureColumn('spec_snapshots', 'mockup', 'TEXT');
 ensureColumn('spec_snapshots', 'file_relation_graph', 'TEXT');
+ensureColumn('spec_snapshots', 'resource_urls_json', 'TEXT');
 db.exec(`
   CREATE TABLE IF NOT EXISTS spec_message_attachments (
     attachment_id   TEXT PRIMARY KEY,
@@ -1812,6 +1817,7 @@ db.exec(`
     target_label                       TEXT,
     selected_definition_snapshots_json TEXT NOT NULL,
     initial_workspace_identity_json    TEXT NOT NULL,
+    final_workspace_identity_json      TEXT,
     configuration_fingerprint          TEXT NOT NULL,
     stop_requested                     INTEGER NOT NULL DEFAULT 0,
     queued_count                       INTEGER NOT NULL DEFAULT 0,
@@ -1822,8 +1828,11 @@ db.exec(`
     interrupted_count                  INTEGER NOT NULL DEFAULT 0,
     rerun_of_batch_run_id              TEXT,
     automation_boundary_purpose        TEXT,
+    purpose                            TEXT NOT NULL DEFAULT 'manual',
+    causal_source_run_id               TEXT,
     FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
     FOREIGN KEY (rerun_of_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (causal_source_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     CHECK (target_kind IN ('repo_root', 'bundle')),
     CHECK ((target_kind = 'repo_root' AND target_bundle_id IS NULL)
       OR (target_kind = 'bundle' AND target_bundle_id IS NOT NULL AND length(trim(target_bundle_id)) > 0)),
@@ -1837,6 +1846,19 @@ db.exec(`
   )
 `);
 ensureColumn('check_batch_details', 'automation_boundary_purpose', 'TEXT');
+ensureColumn('check_batch_details', 'final_workspace_identity_json', 'TEXT');
+ensureColumn('check_batch_details', 'purpose', "TEXT NOT NULL DEFAULT 'manual'");
+ensureColumn('check_batch_details', 'causal_source_run_id', 'TEXT');
+db.exec(`
+  UPDATE check_batch_details
+  SET purpose = 'automation_gate'
+  WHERE automation_boundary_purpose IS NOT NULL AND purpose = 'manual'
+`);
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_check_batch_post_build_source
+  ON check_batch_details(causal_source_run_id)
+  WHERE purpose = 'post_build'
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS check_attempt_details (
     execution_run_id                TEXT PRIMARY KEY,
@@ -1862,13 +1884,420 @@ db.exec(`
     FOREIGN KEY (rerun_of_attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     CHECK (length(definition_id) BETWEEN 1 AND 500),
     CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
-    CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure', 'timeout',
+    CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
+      'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
       'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss')),
     CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
       AND total_persisted_bytes >= retained_end_offset),
     CHECK (output_retention_state IN ('retained', 'expired'))
   )
 `);
+ensureColumn('check_attempt_details', 'retained_end_offset', 'INTEGER NOT NULL DEFAULT 0');
+ensureColumn('check_attempt_details', 'retained_output', "TEXT NOT NULL DEFAULT ''");
+const checkAttemptSchema = db.prepare(`
+  SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'check_attempt_details'
+`).get();
+if (checkAttemptSchema && !checkAttemptSchema.sql.includes('evidence_persistence_failure')) {
+    db.transaction(() => {
+        db.exec(`
+      DROP TRIGGER IF EXISTS preserve_check_attempt_snapshots;
+      DROP TRIGGER IF EXISTS preserve_completed_check_attempt_details;
+      ALTER TABLE check_attempt_details RENAME TO check_attempt_details_legacy;
+
+      CREATE TABLE check_attempt_details (
+        execution_run_id                TEXT PRIMARY KEY,
+        batch_run_id                    TEXT NOT NULL,
+        definition_id                  TEXT NOT NULL,
+        command_snapshot_json           TEXT NOT NULL,
+        definition_fingerprint          TEXT NOT NULL,
+        initial_workspace_identity_json TEXT NOT NULL,
+        final_workspace_identity_json   TEXT,
+        outcome                         TEXT,
+        rerun_of_attempt_run_id         TEXT,
+        exit_code                       INTEGER,
+        exit_signal                     TEXT,
+        exit_error                      TEXT,
+        output_revision                 INTEGER NOT NULL DEFAULT 0,
+        retained_start_offset           INTEGER NOT NULL DEFAULT 0,
+        retained_end_offset             INTEGER NOT NULL DEFAULT 0,
+        total_persisted_bytes           INTEGER NOT NULL DEFAULT 0,
+        retained_output                 TEXT NOT NULL DEFAULT '',
+        output_retention_state          TEXT NOT NULL DEFAULT 'retained',
+        FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
+        FOREIGN KEY (batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (rerun_of_attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        CHECK (length(definition_id) BETWEEN 1 AND 500),
+        CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
+        CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
+          'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
+          'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss')),
+        CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
+          AND total_persisted_bytes >= retained_end_offset),
+        CHECK (output_retention_state IN ('retained', 'expired'))
+      );
+
+      INSERT INTO check_attempt_details (
+        execution_run_id, batch_run_id, definition_id, command_snapshot_json, definition_fingerprint,
+        initial_workspace_identity_json, final_workspace_identity_json, outcome, rerun_of_attempt_run_id,
+        exit_code, exit_signal, exit_error, output_revision, retained_start_offset, retained_end_offset,
+        total_persisted_bytes, retained_output, output_retention_state
+      )
+      SELECT
+        execution_run_id, batch_run_id, definition_id, command_snapshot_json, definition_fingerprint,
+        initial_workspace_identity_json, final_workspace_identity_json, outcome, rerun_of_attempt_run_id,
+        exit_code, exit_signal, exit_error, output_revision, retained_start_offset, retained_end_offset,
+        total_persisted_bytes, retained_output, output_retention_state
+      FROM check_attempt_details_legacy;
+
+      DROP TABLE check_attempt_details_legacy;
+    `);
+    })();
+}
+db.exec(`
+  CREATE TABLE IF NOT EXISTS check_attempt_diagnostic_parsers (
+    attempt_run_id   TEXT PRIMARY KEY,
+    definition_id   TEXT NOT NULL,
+    parser_kind     TEXT NOT NULL DEFAULT 'none',
+    parser_version  TEXT,
+    status          TEXT NOT NULL DEFAULT 'pending',
+    diagnostic_count INTEGER NOT NULL DEFAULT 0,
+    truncated       INTEGER NOT NULL DEFAULT 0,
+    retention_state TEXT NOT NULL DEFAULT 'retained',
+    created_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (attempt_run_id) REFERENCES check_attempt_details(execution_run_id) ON DELETE CASCADE,
+    CHECK (length(definition_id) BETWEEN 1 AND 500),
+    CHECK (parser_kind IN ('typescript', 'eslint', 'none')),
+    CHECK ((parser_kind = 'none' AND parser_version IS NULL) OR (parser_kind <> 'none' AND length(parser_version) BETWEEN 1 AND 32)),
+    CHECK (status IN ('pending', 'complete', 'unsupported', 'malformed', 'interrupted')),
+    CHECK (diagnostic_count BETWEEN 0 AND 500),
+    CHECK (truncated IN (0, 1)),
+    CHECK (retention_state IN ('retained', 'expired'))
+  );
+
+  CREATE TABLE IF NOT EXISTS check_attempt_diagnostics (
+    id             TEXT PRIMARY KEY,
+    attempt_run_id TEXT NOT NULL,
+    definition_id TEXT NOT NULL,
+    ordinal        INTEGER NOT NULL,
+    severity       TEXT NOT NULL,
+    message        TEXT NOT NULL,
+    code           TEXT,
+    file_path      TEXT,
+    start_line     INTEGER,
+    start_column   INTEGER,
+    end_line       INTEGER,
+    end_column     INTEGER,
+    created_at     DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (attempt_run_id, ordinal),
+    FOREIGN KEY (attempt_run_id) REFERENCES check_attempt_details(execution_run_id) ON DELETE CASCADE,
+    CHECK (length(id) BETWEEN 1 AND 100),
+    CHECK (length(definition_id) BETWEEN 1 AND 500),
+    CHECK (severity IN ('error', 'warning', 'info', 'unknown')),
+    CHECK (length(CAST(message AS BLOB)) BETWEEN 1 AND 16384),
+    CHECK (code IS NULL OR length(CAST(code AS BLOB)) BETWEEN 1 AND 256),
+    CHECK (file_path IS NULL OR length(CAST(file_path AS BLOB)) BETWEEN 1 AND 4096),
+    CHECK ((file_path IS NULL AND start_line IS NULL AND start_column IS NULL AND end_line IS NULL AND end_column IS NULL)
+      OR (file_path IS NOT NULL AND start_line >= 1 AND start_column >= 1
+        AND ((end_line IS NULL AND end_column IS NULL)
+          OR (end_line >= start_line AND end_column >= 1 AND (end_line > start_line OR end_column >= start_column))))),
+    CHECK (ordinal BETWEEN 0 AND 499)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_diagnostic_parser_insert
+  BEFORE INSERT ON check_attempt_diagnostic_parsers
+  WHEN NOT EXISTS (
+    SELECT 1 FROM check_attempt_details attempt
+    WHERE attempt.execution_run_id = NEW.attempt_run_id AND attempt.definition_id = NEW.definition_id
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check diagnostic parser ownership');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_diagnostic_insert
+  BEFORE INSERT ON check_attempt_diagnostics
+  WHEN NOT EXISTS (
+    SELECT 1
+    FROM check_attempt_diagnostic_parsers parser
+    WHERE parser.attempt_run_id = NEW.attempt_run_id
+      AND parser.definition_id = NEW.definition_id
+      AND parser.status = 'pending'
+      AND parser.retention_state = 'retained'
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check diagnostic ownership');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_diagnostics
+  BEFORE UPDATE ON check_attempt_diagnostics
+  BEGIN
+    SELECT RAISE(ABORT, 'Check diagnostics are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_diagnostic_parser_ownership
+  BEFORE UPDATE OF attempt_run_id, definition_id, created_at ON check_attempt_diagnostic_parsers
+  BEGIN
+    SELECT RAISE(ABORT, 'Check diagnostic parser ownership is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS interrupt_incomplete_check_diagnostic_parser
+  AFTER UPDATE OF outcome ON check_attempt_details
+  WHEN NEW.outcome IS NOT NULL
+  BEGIN
+    UPDATE check_attempt_diagnostic_parsers
+    SET status = 'interrupted', diagnostic_count = (
+      SELECT COUNT(*) FROM check_attempt_diagnostics diagnostic
+      WHERE diagnostic.attempt_run_id = NEW.execution_run_id
+    ), updated_at = CURRENT_TIMESTAMP
+    WHERE attempt_run_id = NEW.execution_run_id AND status = 'pending';
+  END;
+`);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS check_repair_details (
+    execution_run_id                   TEXT PRIMARY KEY,
+    source_batch_run_id                TEXT NOT NULL,
+    target_kind                        TEXT NOT NULL,
+    target_bundle_id                   TEXT,
+    ticket_id                          TEXT NOT NULL,
+    automation_progression_run_id      TEXT,
+    automation_boundary_purpose        TEXT,
+    initial_workspace_identity_json    TEXT NOT NULL,
+    configuration_fingerprint          TEXT NOT NULL,
+    effective_policy_fingerprint       TEXT,
+    definition_ids_json                TEXT NOT NULL,
+    follow_up_run_id                   TEXT,
+    rerun_batch_run_id                 TEXT,
+    terminal_result                    TEXT,
+    terminal_message                   TEXT,
+    retry_of_check_repair_run_id       TEXT,
+    created_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
+    FOREIGN KEY (source_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (automation_progression_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (follow_up_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (rerun_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (retry_of_check_repair_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    CHECK (target_kind IN ('repo_root', 'bundle')),
+    CHECK ((target_kind = 'repo_root' AND target_bundle_id IS NULL)
+      OR (target_kind = 'bundle' AND target_bundle_id IS NOT NULL AND length(trim(target_bundle_id)) > 0)),
+    CHECK (length(configuration_fingerprint) = 64 AND configuration_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (effective_policy_fingerprint IS NULL OR (
+      length(effective_policy_fingerprint) = 64 AND effective_policy_fingerprint NOT GLOB '*[^0-9a-f]*'
+    )),
+    CHECK (automation_boundary_purpose IS NULL OR automation_boundary_purpose IN (
+      'automation_review', 'automation_commit', 'automation_push', 'automation_pull_request'
+    )),
+    CHECK ((automation_progression_run_id IS NULL AND automation_boundary_purpose IS NULL)
+      OR (automation_progression_run_id IS NOT NULL AND automation_boundary_purpose IS NOT NULL)),
+    CHECK ((automation_progression_run_id IS NULL AND effective_policy_fingerprint IS NULL)
+      OR (automation_progression_run_id IS NOT NULL AND effective_policy_fingerprint IS NOT NULL)),
+    CHECK (terminal_result IS NULL OR terminal_result IN ('passed', 'failed', 'cancelled', 'interrupted')),
+    CHECK (terminal_message IS NULL OR length(CAST(terminal_message AS BLOB)) <= 16384)
+  );
+
+  CREATE TABLE IF NOT EXISTS check_repair_diagnostic_provenance (
+    check_repair_run_id TEXT NOT NULL,
+    ordinal             INTEGER NOT NULL,
+    diagnostic_id       TEXT NOT NULL,
+    attempt_run_id      TEXT NOT NULL,
+    definition_id       TEXT NOT NULL,
+    PRIMARY KEY (check_repair_run_id, ordinal),
+    UNIQUE (check_repair_run_id, diagnostic_id),
+    FOREIGN KEY (check_repair_run_id) REFERENCES check_repair_details(execution_run_id) ON DELETE CASCADE,
+    FOREIGN KEY (attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    CHECK (ordinal >= 0)
+  );
+
+  CREATE TABLE IF NOT EXISTS check_repair_raw_output_provenance (
+    check_repair_run_id TEXT NOT NULL,
+    ordinal             INTEGER NOT NULL,
+    attempt_run_id      TEXT NOT NULL,
+    definition_id       TEXT NOT NULL,
+    PRIMARY KEY (check_repair_run_id, ordinal),
+    UNIQUE (check_repair_run_id, attempt_run_id),
+    FOREIGN KEY (check_repair_run_id) REFERENCES check_repair_details(execution_run_id) ON DELETE CASCADE,
+    FOREIGN KEY (attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    CHECK (ordinal >= 0)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_repair_provenance
+  BEFORE UPDATE OF execution_run_id, source_batch_run_id, target_kind, target_bundle_id, ticket_id,
+    automation_progression_run_id, automation_boundary_purpose, initial_workspace_identity_json,
+    configuration_fingerprint, effective_policy_fingerprint, definition_ids_json,
+    retry_of_check_repair_run_id, created_at
+    ON check_repair_details
+  BEGIN
+    SELECT RAISE(ABORT, 'Check repair provenance is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_repair_diagnostic_provenance
+  BEFORE UPDATE ON check_repair_diagnostic_provenance
+  BEGIN
+    SELECT RAISE(ABORT, 'Check repair diagnostic provenance is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_repair_raw_output_provenance
+  BEFORE UPDATE ON check_repair_raw_output_provenance
+  BEGIN
+    SELECT RAISE(ABORT, 'Check repair raw output provenance is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS prevent_check_repair_raw_output_provenance_delete
+  BEFORE DELETE ON check_repair_raw_output_provenance
+  WHEN EXISTS (
+    SELECT 1
+    FROM check_repair_details repair
+    JOIN execution_runs repair_run ON repair_run.id = repair.execution_run_id
+    JOIN projects project ON project.id = repair_run.project_id
+    WHERE repair.execution_run_id = OLD.check_repair_run_id
+      AND project.deletion_started_at IS NULL
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Check repair raw output provenance is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_repair_details_insert
+  BEFORE INSERT ON check_repair_details
+  WHEN NOT EXISTS (
+    SELECT 1
+    FROM execution_runs repair
+    JOIN execution_runs source ON source.id = NEW.source_batch_run_id AND source.project_id = repair.project_id
+    JOIN check_batch_details source_details ON source_details.execution_run_id = source.id
+    JOIN tickets ticket ON ticket.id = NEW.ticket_id AND ticket.project_id = repair.project_id
+    WHERE repair.id = NEW.execution_run_id AND repair.kind = 'check_repair'
+      AND NEW.target_kind = 'bundle' AND NEW.target_bundle_id IS NOT NULL
+      AND source.kind = 'check_batch' AND source.status = 'failed'
+      AND source_details.target_kind = NEW.target_kind
+      AND source_details.target_bundle_id IS NEW.target_bundle_id
+      AND source_details.automation_boundary_purpose IS NEW.automation_boundary_purpose
+      AND (NEW.follow_up_run_id IS NULL OR EXISTS (
+        SELECT 1 FROM execution_runs follow_up
+        WHERE follow_up.id = NEW.follow_up_run_id AND follow_up.project_id = repair.project_id
+          AND follow_up.kind = 'build_follow_up' AND follow_up.parent_run_id = repair.id
+      ))
+      AND ticket.worktree_bundle_id = NEW.target_bundle_id
+      AND (NEW.retry_of_check_repair_run_id IS NULL OR EXISTS (
+        SELECT 1 FROM execution_runs retry_source
+        WHERE retry_source.id = NEW.retry_of_check_repair_run_id
+          AND retry_source.project_id = repair.project_id
+          AND retry_source.kind = 'check_repair'
+          AND retry_source.status IN ('completed', 'failed', 'cancelled', 'interrupted')
+      ))
+      AND ((NEW.automation_progression_run_id IS NULL
+          AND repair.parent_run_id IS NULL AND repair.initiated_by = 'user'
+          AND source.parent_run_id IS NULL AND source.initiated_by = 'user')
+        OR (NEW.automation_progression_run_id = repair.parent_run_id AND repair.initiated_by = 'automation'
+          AND source.parent_run_id = NEW.automation_progression_run_id AND source.initiated_by = 'automation'
+          AND EXISTS (
+            SELECT 1 FROM execution_runs progression
+            WHERE progression.id = NEW.automation_progression_run_id
+              AND progression.project_id = repair.project_id
+              AND progression.kind = 'automation_progression'
+              AND progression.status IN ('queued', 'running', 'waiting')
+          )))
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check repair details');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_repair_diagnostic_provenance_insert
+  BEFORE INSERT ON check_repair_diagnostic_provenance
+  WHEN NOT EXISTS (
+    SELECT 1
+    FROM check_repair_details repair
+    JOIN check_attempt_diagnostics diagnostic ON diagnostic.id = NEW.diagnostic_id
+    JOIN check_attempt_details attempt ON attempt.execution_run_id = NEW.attempt_run_id
+    JOIN execution_runs attempt_run ON attempt_run.id = attempt.execution_run_id
+    JOIN check_attempt_diagnostic_parsers parser ON parser.attempt_run_id = attempt.execution_run_id
+    WHERE repair.execution_run_id = NEW.check_repair_run_id
+      AND diagnostic.attempt_run_id = attempt.execution_run_id
+      AND diagnostic.definition_id = NEW.definition_id
+      AND attempt.definition_id = NEW.definition_id
+      AND attempt.batch_run_id = repair.source_batch_run_id
+      AND attempt.outcome = 'command_failure' AND attempt_run.status = 'failed'
+      AND attempt.output_retention_state = 'retained' AND length(attempt.retained_output) > 0
+      AND parser.status = 'complete' AND parser.retention_state = 'retained'
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check repair diagnostic provenance');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_repair_raw_output_provenance_insert
+  BEFORE INSERT ON check_repair_raw_output_provenance
+  WHEN NOT EXISTS (
+    SELECT 1
+    FROM check_repair_details repair
+    JOIN execution_runs repair_run ON repair_run.id = repair.execution_run_id
+    JOIN check_attempt_details attempt ON attempt.execution_run_id = NEW.attempt_run_id
+    JOIN execution_runs attempt_run ON attempt_run.id = attempt.execution_run_id
+      AND attempt_run.project_id = repair_run.project_id
+    JOIN execution_runs batch_run ON batch_run.id = attempt.batch_run_id
+      AND batch_run.project_id = repair_run.project_id
+    WHERE repair.execution_run_id = NEW.check_repair_run_id
+      AND repair_run.kind = 'check_repair'
+      AND attempt.definition_id = NEW.definition_id
+      AND attempt.batch_run_id = repair.source_batch_run_id
+      AND attempt.outcome = 'command_failure'
+      AND attempt_run.kind = 'check_attempt' AND attempt_run.status = 'failed'
+      AND batch_run.kind = 'check_batch' AND batch_run.status = 'failed'
+      AND attempt.output_retention_state = 'retained'
+      AND length(attempt.retained_output) > 0
+      AND attempt.final_workspace_identity_json IS NOT NULL
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check repair raw output provenance');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_repair_follow_up_update
+  BEFORE UPDATE OF follow_up_run_id ON check_repair_details
+  WHEN NEW.follow_up_run_id IS NOT OLD.follow_up_run_id AND (
+    OLD.follow_up_run_id IS NOT NULL OR NEW.follow_up_run_id IS NULL OR NOT EXISTS (
+      SELECT 1
+      FROM execution_runs repair
+      JOIN execution_runs follow_up ON follow_up.id = NEW.follow_up_run_id
+        AND follow_up.project_id = repair.project_id
+      WHERE repair.id = OLD.execution_run_id AND repair.kind = 'check_repair'
+        AND follow_up.kind = 'build_follow_up' AND follow_up.parent_run_id = repair.id
+    )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check repair follow-up ownership');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_check_repair_rerun_update
+  BEFORE UPDATE OF rerun_batch_run_id ON check_repair_details
+  WHEN NEW.rerun_batch_run_id IS NOT OLD.rerun_batch_run_id AND (
+    OLD.rerun_batch_run_id IS NOT NULL OR NEW.rerun_batch_run_id IS NULL OR NOT EXISTS (
+      SELECT 1
+      FROM execution_runs repair
+      JOIN execution_runs rerun ON rerun.id = NEW.rerun_batch_run_id
+        AND rerun.project_id = repair.project_id
+      JOIN check_batch_details rerun_details ON rerun_details.execution_run_id = rerun.id
+      WHERE repair.id = OLD.execution_run_id AND repair.kind = 'check_repair'
+        AND rerun.kind = 'check_batch'
+        AND rerun_details.rerun_of_batch_run_id = OLD.source_batch_run_id
+        AND rerun_details.target_kind = OLD.target_kind
+        AND rerun_details.target_bundle_id IS OLD.target_bundle_id
+        AND rerun_details.automation_boundary_purpose IS OLD.automation_boundary_purpose
+        AND ((OLD.automation_progression_run_id IS NULL
+            AND rerun.initiated_by = 'user' AND rerun.parent_run_id IS NULL)
+          OR (OLD.automation_progression_run_id IS NOT NULL
+            AND rerun.initiated_by = 'automation'
+            AND rerun.parent_run_id = OLD.automation_progression_run_id))
+    )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid check repair rerun ownership');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_repair_terminal_result
+  BEFORE UPDATE OF terminal_result ON check_repair_details
+  WHEN OLD.terminal_result IS NOT NULL AND NEW.terminal_result IS NOT OLD.terminal_result
+  BEGIN
+    SELECT RAISE(ABORT, 'Check repair terminal result is immutable');
+  END;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS check_gate_evaluations (
     id                              TEXT PRIMARY KEY,
@@ -2075,15 +2504,23 @@ db.prepare(`
 `).run();
 db.exec('DROP TRIGGER IF EXISTS validate_check_batch_details_insert');
 db.exec('DROP TRIGGER IF EXISTS preserve_check_batch_snapshots');
+db.exec('DROP TRIGGER IF EXISTS preserve_completed_check_batch_details');
 db.exec(`
   CREATE TRIGGER IF NOT EXISTS preserve_check_batch_snapshots
   BEFORE UPDATE OF execution_run_id, target_kind, target_bundle_id, target_label,
     selected_definition_snapshots_json, initial_workspace_identity_json, configuration_fingerprint,
-    rerun_of_batch_run_id, automation_boundary_purpose ON check_batch_details
+    rerun_of_batch_run_id, automation_boundary_purpose, purpose, causal_source_run_id ON check_batch_details
   BEGIN
     SELECT RAISE(ABORT, 'Check batch snapshots are immutable');
   END;
 
+  CREATE TRIGGER IF NOT EXISTS preserve_completed_check_batch_details
+  BEFORE UPDATE OF final_workspace_identity_json ON check_batch_details
+  WHEN OLD.final_workspace_identity_json IS NOT NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'Completed check batch details are immutable');
+  END;
+
   CREATE TRIGGER IF NOT EXISTS preserve_check_attempt_snapshots
   BEFORE UPDATE OF execution_run_id, batch_run_id, definition_id, command_snapshot_json,
     definition_fingerprint, initial_workspace_identity_json, rerun_of_attempt_run_id
@@ -2108,9 +2545,41 @@ db.exec(`
     WHERE run.id = NEW.execution_run_id
       AND run.kind = 'check_batch'
       AND (
-        (run.parent_run_id IS NULL AND run.initiated_by <> 'automation')
+        (run.parent_run_id IS NULL AND run.initiated_by <> 'automation'
+          AND NEW.purpose = 'manual' AND NEW.causal_source_run_id IS NULL)
+        OR (
+          run.initiated_by = 'system'
+          AND NEW.purpose = 'post_build'
+          AND NEW.automation_boundary_purpose IS NULL
+          AND NEW.rerun_of_batch_run_id IS NULL
+          AND NEW.causal_source_run_id = run.parent_run_id
+          AND EXISTS (
+            SELECT 1
+            FROM execution_runs source
+            WHERE source.id = run.parent_run_id
+              AND source.project_id = run.project_id
+              AND source.kind IN ('build', 'build_follow_up', 'chat_turn')
+              AND source.status = 'completed'
+              AND EXISTS (
+                SELECT 1
+                FROM execution_run_links source_owner
+                JOIN execution_run_links batch_owner
+                  ON batch_owner.execution_run_id = run.id
+                  AND batch_owner.project_id = run.project_id
+                  AND batch_owner.relationship = 'primary'
+                  AND batch_owner.entity_type = source_owner.entity_type
+                  AND batch_owner.entity_id = source_owner.entity_id
+                WHERE source_owner.execution_run_id = source.id
+                  AND source_owner.project_id = source.project_id
+                  AND source_owner.relationship = 'primary'
+                  AND source_owner.entity_type IN ('ticket', 'chat_session')
+              )
+          )
+        )
         OR (
           run.initiated_by = 'automation'
+          AND NEW.purpose = 'automation_gate'
+          AND NEW.causal_source_run_id IS NULL
           AND NEW.automation_boundary_purpose IN ('automation_review', 'automation_commit', 'automation_push', 'automation_pull_request')
           AND EXISTS (
             SELECT 1
@@ -2137,14 +2606,28 @@ db.exec(`
                 OR (NEW.target_kind = 'repo_root' AND NEW.target_bundle_id IS NULL
                   AND bundle.kind = 'project_root')
               )
-              AND NOT EXISTS (
-                SELECT 1 FROM execution_runs sibling
+               AND NOT EXISTS (
+                 SELECT 1 FROM execution_runs sibling
                 WHERE sibling.project_id = run.project_id
                   AND sibling.parent_run_id = progression.id
                   AND sibling.id <> run.id
-                  AND sibling.kind IN ('check_batch', 'review', 'automation_review_fix', 'automation_commit', 'automation_push', 'automation_pull_request')
-                  AND sibling.status IN ('queued', 'running', 'waiting')
-              )
+                   AND sibling.kind IN ('check_batch', 'check_repair', 'review', 'automation_review_fix', 'automation_commit', 'automation_push', 'automation_pull_request')
+                   AND sibling.status IN ('queued', 'running', 'waiting')
+                   AND NOT (
+                     sibling.kind = 'check_repair'
+                     AND NEW.rerun_of_batch_run_id IS NOT NULL
+                     AND EXISTS (
+                       SELECT 1 FROM check_repair_details repair_details
+                       WHERE repair_details.execution_run_id = sibling.id
+                         AND repair_details.source_batch_run_id = NEW.rerun_of_batch_run_id
+                         AND repair_details.terminal_result IS NULL
+                         AND repair_details.automation_progression_run_id = progression.id
+                         AND repair_details.automation_boundary_purpose = NEW.automation_boundary_purpose
+                         AND repair_details.target_kind = NEW.target_kind
+                         AND repair_details.target_bundle_id IS NEW.target_bundle_id
+                     )
+                   )
+               )
           )
       )
       AND (run.initiated_by = 'automation' OR NEW.automation_boundary_purpose IS NULL)
@@ -2414,6 +2897,12 @@ db.exec('CREATE INDEX IF NOT EXISTS idx_github_actions_details_dispatch ON githu
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_batches_rerun ON check_batch_details(rerun_of_batch_run_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_attempts_batch ON check_attempt_details(batch_run_id, definition_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_attempts_rerun ON check_attempt_details(rerun_of_attempt_run_id)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_diagnostics_attempt ON check_attempt_diagnostics(attempt_run_id, ordinal)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_diagnostic_parsers_retention ON check_attempt_diagnostic_parsers(retention_state, attempt_run_id)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_repairs_source ON check_repair_details(source_batch_run_id, created_at DESC)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_repairs_progression ON check_repair_details(automation_progression_run_id, terminal_result)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_repair_diagnostics_attempt ON check_repair_diagnostic_provenance(attempt_run_id)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_check_repair_raw_output_attempt ON check_repair_raw_output_provenance(attempt_run_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_gate_evaluations_target ON check_gate_evaluations(project_id, target_kind, target_bundle_id, created_at DESC, id DESC)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_gate_evaluations_batch ON check_gate_evaluations(source_batch_run_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_check_gate_evaluation_attempts_run ON check_gate_evaluation_attempts(attempt_run_id)');
@@ -2537,6 +3026,7 @@ db.exec(`
     fix_loop_active          INTEGER NOT NULL DEFAULT 0,
     automation_progression_run_id TEXT,
     automation_paused_stage_run_id TEXT,
+    automation_paused_boundary_purpose TEXT,
     automation_pause_reason_code TEXT,
     automation_paused_code   TEXT,
     automation_paused_reason TEXT,
@@ -2545,12 +3035,16 @@ db.exec(`
     updated_at               DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     PRIMARY KEY (project_id, worktree_bundle_id),
     FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
-    FOREIGN KEY (worktree_bundle_id) REFERENCES worktree_bundles(id) ON DELETE CASCADE
+    FOREIGN KEY (worktree_bundle_id) REFERENCES worktree_bundles(id) ON DELETE CASCADE,
+    CHECK (automation_paused_boundary_purpose IS NULL OR automation_paused_boundary_purpose IN (
+      'automation_review', 'automation_commit', 'automation_push', 'automation_pull_request'
+    ))
   )
 `);
 ensureColumn('bundle_automation_state', 'automation_paused_code', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_progression_run_id', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_paused_stage_run_id', 'TEXT');
+ensureColumn('bundle_automation_state', 'automation_paused_boundary_purpose', 'TEXT');
 ensureColumn('bundle_automation_state', 'automation_pause_reason_code', 'TEXT');
 db.exec(`
   CREATE TABLE IF NOT EXISTS automation_stage_details (