@straiffi/archon 1.8.19 → 1.8.21

package/dist/server/db.js

@@ -3,6 +3,7 @@ import { createHash } from 'crypto';
 import { parseCheckDefinitionsJsonStrict, parseLegacyTestCommandsJsonStrict, projectCheckDefinitionsToTestCommands, } from './lib/checkDefinitions.js';
 import { ensureParentDirectory, resolveArchonDbPath } from './lib/runtimePaths.js';
 import { TRANSCRIPT_RUN_TEXT_LIMIT_BYTES, truncateUtf8 } from './lib/transcriptRuns.js';
+import { createExecutionProfile, fingerprintExecutionProfile, serializeExecutionProfile, } from './lib/executionProfiles.js';
 const dbPath = ensureParentDirectory(resolveArchonDbPath());
 const db = new Database(dbPath);
 db.pragma('foreign_keys = ON');
@@ -55,6 +56,7 @@ db.exec(`
     name         TEXT NOT NULL,
     repo_path    TEXT NOT NULL,
     build_execution_provider TEXT NOT NULL DEFAULT 'host' CHECK (build_execution_provider IN ('host', 'docker_sandbox')),
+    active_execution_profile_revision_id TEXT NOT NULL DEFAULT '',
     active_target_kind TEXT NOT NULL DEFAULT 'repo_root',
     active_target_bundle_id TEXT,
     worktree_cmd TEXT,
@@ -148,6 +150,7 @@ db.exec('UPDATE worktree_bundles SET required_check_policy_override = NULL WHERE
 ensureColumn('projects', 'worktree_sync', 'TEXT');
 ensureColumn('projects', 'build_execution_provider', "TEXT NOT NULL DEFAULT 'host'");
 db.exec("UPDATE projects SET build_execution_provider = 'host' WHERE build_execution_provider IS NULL OR build_execution_provider NOT IN ('host', 'docker_sandbox')");
+ensureColumn('projects', 'active_execution_profile_revision_id', "TEXT NOT NULL DEFAULT ''");
 ensureColumn('projects', 'active_target_kind', "TEXT NOT NULL DEFAULT 'repo_root'");
 ensureColumn('projects', 'active_target_bundle_id', 'TEXT');
 ensureColumn('projects', 'check_definitions', 'TEXT');
@@ -173,6 +176,175 @@ ensureColumn('projects', 'spec_aware_code_review_enabled', 'INTEGER NOT NULL DEF
 ensureColumn('projects', 'deletion_started_at', 'DATETIME');
 ensureColumn('projects', 'deletion_claim_id', 'TEXT');
 ensureColumn('projects', 'deletion_cleanup_started_at', 'DATETIME');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS execution_profile_revisions (
+    id             TEXT PRIMARY KEY,
+    project_id     TEXT NOT NULL,
+    revision       INTEGER NOT NULL CHECK (revision > 0),
+    schema_version INTEGER NOT NULL CHECK (schema_version = 1),
+    fingerprint    TEXT NOT NULL CHECK (length(fingerprint) = 64),
+    profile_json   TEXT NOT NULL CHECK (
+      json_valid(profile_json)
+      AND json_type(profile_json) = 'object'
+      AND length(CAST(profile_json AS BLOB)) BETWEEN 2 AND 16384
+    ),
+    created_at     DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (project_id, revision),
+    UNIQUE (project_id, fingerprint),
+    UNIQUE (project_id, id),
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+  );
+
+  CREATE TABLE IF NOT EXISTS execution_profile_audit_events (
+    id                           TEXT PRIMARY KEY,
+    project_id                   TEXT NOT NULL,
+    event_type                   TEXT NOT NULL CHECK (event_type IN ('revision_created', 'revision_activated')),
+    profile_revision_id          TEXT NOT NULL,
+    previous_profile_revision_id TEXT,
+    metadata_json                TEXT CHECK (
+      metadata_json IS NULL OR (
+        json_valid(metadata_json)
+        AND json_type(metadata_json) = 'object'
+        AND length(CAST(metadata_json AS BLOB)) BETWEEN 2 AND 16384
+      )
+    ),
+    created_at                   DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (project_id, profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id, previous_profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE CASCADE
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_execution_profile_revisions_project
+    ON execution_profile_revisions(project_id, revision DESC);
+  CREATE INDEX IF NOT EXISTS idx_execution_profile_audit_project
+    ON execution_profile_audit_events(project_id, created_at DESC, id DESC);
+`);
+const backfillExecutionProfiles = () => {
+    const projects = db.prepare(`
+    SELECT id, build_execution_provider, active_execution_profile_revision_id
+    FROM projects
+  `).all();
+    const findOwnedRevision = db.prepare(`
+    SELECT 1 FROM execution_profile_revisions WHERE project_id = ? AND id = ?
+  `);
+    const insertRevision = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (?, ?, 1, 1, ?, ?)
+  `);
+    const activateRevision = db.prepare(`
+    UPDATE projects SET active_execution_profile_revision_id = ? WHERE id = ?
+  `);
+    const insertEvent = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (?, ?, 'revision_created', ?, NULL)
+  `);
+    db.transaction(() => {
+        for (const project of projects) {
+            if (project.active_execution_profile_revision_id
+                && findOwnedRevision.get(project.id, project.active_execution_profile_revision_id)) {
+                continue;
+            }
+            const profile = createExecutionProfile(project.build_execution_provider);
+            const profileJson = serializeExecutionProfile(profile);
+            const fingerprint = fingerprintExecutionProfile(profile);
+            const revisionId = `${project.id}:execution-profile:1`;
+            insertRevision.run(revisionId, project.id, fingerprint, profileJson);
+            activateRevision.run(revisionId, project.id);
+            insertEvent.run(`${revisionId}:created`, project.id, revisionId);
+        }
+    })();
+};
+backfillExecutionProfiles();
+const hostCompatibilityProfile = createExecutionProfile('host');
+const hostCompatibilityProfileJson = serializeExecutionProfile(hostCompatibilityProfile).replaceAll("'", "''");
+const hostCompatibilityFingerprint = fingerprintExecutionProfile(hostCompatibilityProfile);
+const dockerProfile = createExecutionProfile('docker_sandbox');
+const dockerProfileJson = serializeExecutionProfile(dockerProfile).replaceAll("'", "''");
+const dockerProfileFingerprint = fingerprintExecutionProfile(dockerProfile);
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS create_project_execution_profile
+  AFTER INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id = ''
+  BEGIN
+    INSERT INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (
+      NEW.id || ':execution-profile:1', NEW.id, 1, 1,
+      CASE WHEN NEW.build_execution_provider = 'docker_sandbox'
+        THEN '${dockerProfileFingerprint}' ELSE '${hostCompatibilityFingerprint}' END,
+      CASE WHEN NEW.build_execution_provider = 'docker_sandbox'
+        THEN '${dockerProfileJson}' ELSE '${hostCompatibilityProfileJson}' END
+    );
+    UPDATE projects
+    SET active_execution_profile_revision_id = NEW.id || ':execution-profile:1'
+    WHERE id = NEW.id;
+    INSERT INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (
+      NEW.id || ':execution-profile:1:created', NEW.id, 'revision_created',
+      NEW.id || ':execution-profile:1', NULL
+    );
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_owner_insert
+  BEFORE INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id <> '' AND NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id AND id = NEW.active_execution_profile_revision_id
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Active execution profile revision is not owned by project');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_owner_update
+  BEFORE UPDATE OF active_execution_profile_revision_id ON projects
+  WHEN NEW.active_execution_profile_revision_id = '' OR NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id AND id = NEW.active_execution_profile_revision_id
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Active execution profile revision is not owned by project');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_projection_insert
+  BEFORE INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id <> '' AND NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id
+      AND id = NEW.active_execution_profile_revision_id
+      AND json_extract(profile_json, '$.provider_preference') = NEW.build_execution_provider
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Build execution provider must project the active execution profile');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_projection_update
+  BEFORE UPDATE OF active_execution_profile_revision_id, build_execution_provider ON projects
+  WHEN NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id
+      AND id = NEW.active_execution_profile_revision_id
+      AND json_extract(profile_json, '$.provider_preference') = NEW.build_execution_provider
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Build execution provider must project the active execution profile');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_profile_revision
+  BEFORE UPDATE ON execution_profile_revisions
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution profile revisions are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_profile_audit_event
+  BEFORE UPDATE ON execution_profile_audit_events
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution profile audit events are immutable');
+  END;
+`);
 const backfillProjectCheckDefinitions = () => {
     const rows = db.prepare(`
     SELECT id, check_definitions, test_commands
@@ -946,11 +1118,115 @@ db.exec(`
     entered_queue_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
     started_at        DATETIME,
     finished_at       DATETIME,
+    execution_profile_revision_id TEXT,
+    execution_profile_fingerprint TEXT,
+    execution_profile_selection_reason TEXT,
+    activation_execution_run_id TEXT,
     PRIMARY KEY (build_sequence_id, ticket_id),
     FOREIGN KEY (build_sequence_id) REFERENCES build_sequences(id) ON DELETE CASCADE,
     FOREIGN KEY (ticket_id) REFERENCES tickets(id) ON DELETE CASCADE
   )
 `);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS build_sequence_ticket_replacements (
+    id                                 TEXT PRIMARY KEY,
+    build_sequence_id                  TEXT NOT NULL,
+    ticket_id                          TEXT NOT NULL,
+    position                           INTEGER NOT NULL,
+    execution_profile_revision_id      TEXT NOT NULL,
+    execution_profile_fingerprint      TEXT NOT NULL,
+    execution_profile_selection_reason TEXT NOT NULL,
+    replaced_at                        DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (build_sequence_id) REFERENCES build_sequences(id) ON DELETE CASCADE,
+    FOREIGN KEY (ticket_id) REFERENCES tickets(id) ON DELETE CASCADE
+  )
+`);
+ensureColumn('build_sequence_tickets', 'execution_profile_revision_id', 'TEXT');
+ensureColumn('build_sequence_tickets', 'execution_profile_fingerprint', 'TEXT');
+ensureColumn('build_sequence_tickets', 'execution_profile_selection_reason', 'TEXT');
+ensureColumn('build_sequence_tickets', 'activation_execution_run_id', 'TEXT');
+db.transaction(() => {
+    const incompleteSequenceIds = db.prepare(`
+    SELECT DISTINCT build_sequence_id
+    FROM build_sequence_tickets
+    WHERE status IN ('active', 'queued')
+      AND (
+        execution_profile_revision_id IS NULL
+        OR execution_profile_fingerprint IS NULL
+        OR execution_profile_selection_reason IS NULL
+      )
+  `).all();
+    const failActive = db.prepare(`
+    UPDATE build_sequence_tickets
+    SET status = 'failed', finished_at = COALESCE(finished_at, CURRENT_TIMESTAMP)
+    WHERE build_sequence_id = ? AND status = 'active'
+  `);
+    const cancelQueued = db.prepare(`
+    UPDATE build_sequence_tickets
+    SET status = 'cancelled', finished_at = COALESCE(finished_at, CURRENT_TIMESTAMP)
+    WHERE build_sequence_id = ? AND status = 'queued'
+  `);
+    const failSequence = db.prepare(`
+    UPDATE build_sequences SET status = 'failed', updated_at = CURRENT_TIMESTAMP
+    WHERE id = ? AND status = 'active'
+  `);
+    for (const row of incompleteSequenceIds) {
+        failActive.run(row.build_sequence_id);
+        cancelQueued.run(row.build_sequence_id);
+        failSequence.run(row.build_sequence_id);
+    }
+})();
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS validate_build_sequence_ticket_profile_insert
+  BEFORE INSERT ON build_sequence_tickets
+  WHEN NEW.status IN ('active', 'queued')
+    OR NEW.execution_profile_revision_id IS NOT NULL OR NEW.execution_profile_fingerprint IS NOT NULL
+    OR NEW.execution_profile_selection_reason IS NOT NULL
+  BEGIN
+    SELECT CASE WHEN
+      NEW.execution_profile_revision_id IS NULL
+      OR NEW.execution_profile_fingerprint IS NULL
+      OR NEW.execution_profile_selection_reason NOT IN ('project_active_at_acceptance', 'historical_lineage')
+      OR NOT EXISTS (
+        SELECT 1
+        FROM execution_profile_revisions revision
+        JOIN build_sequences sequence ON sequence.id = NEW.build_sequence_id
+        WHERE revision.id = NEW.execution_profile_revision_id
+          AND revision.project_id = sequence.project_id
+          AND revision.fingerprint = NEW.execution_profile_fingerprint
+      )
+    THEN RAISE(ABORT, 'Invalid Build sequence execution profile selection') END;
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_build_sequence_ticket_profile_activation
+  BEFORE UPDATE OF status ON build_sequence_tickets
+  WHEN NEW.status IN ('active', 'queued') AND (
+    NEW.execution_profile_revision_id IS NULL
+    OR NEW.execution_profile_fingerprint IS NULL
+    OR NEW.execution_profile_selection_reason NOT IN ('project_active_at_acceptance', 'historical_lineage')
+    OR NOT EXISTS (
+      SELECT 1
+      FROM execution_profile_revisions revision
+      JOIN build_sequences sequence ON sequence.id = NEW.build_sequence_id
+      WHERE revision.id = NEW.execution_profile_revision_id
+        AND revision.project_id = sequence.project_id
+        AND revision.fingerprint = NEW.execution_profile_fingerprint
+    )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Build sequence execution profile selection');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_build_sequence_ticket_profile
+  BEFORE UPDATE OF execution_profile_revision_id, execution_profile_fingerprint, execution_profile_selection_reason
+  ON build_sequence_tickets
+  WHEN NEW.execution_profile_revision_id IS NOT OLD.execution_profile_revision_id
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.execution_profile_selection_reason IS NOT OLD.execution_profile_selection_reason
+  BEGIN
+    SELECT RAISE(ABORT, 'Build sequence execution profile selection is immutable');
+  END;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS ticket_dependencies (
     blocker_ticket_id   TEXT NOT NULL,
@@ -2132,6 +2408,9 @@ db.exec(`
     environment_revision                INTEGER NOT NULL,
     workspace_mode                      TEXT NOT NULL,
     environment_validation_fingerprint  TEXT NOT NULL,
+    execution_profile_revision_id       TEXT,
+    execution_profile_fingerprint       TEXT,
+    credential_requirements_fingerprint TEXT,
     template_identity                   TEXT,
     template_digest                     TEXT,
     agent_identity                      TEXT,
@@ -2151,6 +2430,7 @@ db.exec(`
     last_used_at                        DATETIME,
     stopped_at                          DATETIME,
     retirement_started_at               DATETIME,
+    retirement_requested_at             DATETIME,
     cleanup_pending_at                  DATETIME,
     retired_at                          DATETIME,
     failed_at                           DATETIME,
@@ -2169,6 +2449,10 @@ db.exec(`
     CHECK (environment_revision >= 1),
     CHECK (workspace_mode = 'direct'),
     CHECK (length(environment_validation_fingerprint) = 64 AND environment_validation_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK ((execution_profile_revision_id IS NULL) = (execution_profile_fingerprint IS NULL)),
+    CHECK ((execution_profile_fingerprint IS NULL) = (credential_requirements_fingerprint IS NULL)),
+    CHECK (execution_profile_fingerprint IS NULL OR (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*')),
+    CHECK (credential_requirements_fingerprint IS NULL OR (length(credential_requirements_fingerprint) = 64 AND credential_requirements_fingerprint NOT GLOB '*[^0-9a-f]*')),
     CHECK ((template_identity IS NULL) <> (template_digest IS NULL)),
     CHECK (template_identity IS NULL OR length(CAST(template_identity AS BLOB)) BETWEEN 1 AND 500),
     CHECK (template_digest IS NULL OR length(CAST(template_digest AS BLOB)) BETWEEN 1 AND 500),
@@ -2214,6 +2498,7 @@ db.exec(`
     relationship                        TEXT NOT NULL,
     environment_revision                INTEGER NOT NULL,
     environment_validation_fingerprint  TEXT NOT NULL,
+    execution_profile_fingerprint       TEXT,
     authority_json                      TEXT,
     placement_json                      TEXT,
     bound_at                            DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -2224,6 +2509,7 @@ db.exec(`
     CHECK (relationship IN ('validation', 'execution')),
     CHECK (environment_revision >= 1),
     CHECK (length(environment_validation_fingerprint) = 64 AND environment_validation_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (execution_profile_fingerprint IS NULL OR (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*')),
     CHECK (relationship <> 'execution' OR length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384),
     CHECK (placement_json IS NULL OR (relationship = 'execution' AND length(CAST(placement_json AS BLOB)) BETWEEN 2 AND 16384))
   );
@@ -2298,8 +2584,146 @@ db.exec(`
     SELECT RAISE(ABORT, 'Execution environment run binding identity is immutable');
   END;
 `);
+ensureColumn('execution_environments', 'execution_profile_revision_id', 'TEXT');
+ensureColumn('execution_environments', 'execution_profile_fingerprint', 'TEXT');
+ensureColumn('execution_environments', 'credential_requirements_fingerprint', 'TEXT');
+ensureColumn('execution_environments', 'retirement_requested_at', 'DATETIME');
+ensureColumn('execution_environment_run_bindings', 'execution_profile_fingerprint', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'authority_json', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'placement_json', 'TEXT');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS execution_run_authorities (
+    execution_run_id                 TEXT NOT NULL,
+    project_id                       TEXT NOT NULL,
+    execution_profile_revision_id    TEXT NOT NULL,
+    execution_profile_fingerprint    TEXT NOT NULL,
+    authority_json                   TEXT NOT NULL,
+    created_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (execution_run_id),
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id, execution_profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE RESTRICT,
+    CHECK (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_run_authority
+  BEFORE UPDATE ON execution_run_authorities
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution run authority is immutable');
+  END;
+
+`);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS build_setup_evidence (
+    id                              TEXT PRIMARY KEY,
+    project_id                      TEXT NOT NULL,
+    execution_run_id                TEXT NOT NULL,
+    target_kind                     TEXT NOT NULL,
+    target_key                      TEXT NOT NULL,
+    target_workspace_path           TEXT NOT NULL,
+    workspace_evidence_state        TEXT NOT NULL,
+    workspace_evidence_fingerprint  TEXT,
+    setup_configuration_fingerprint TEXT NOT NULL,
+    execution_profile_fingerprint   TEXT NOT NULL,
+    provider                        TEXT NOT NULL,
+    environment_revision            INTEGER,
+    command_count                    INTEGER NOT NULL,
+    outcome                          TEXT NOT NULL,
+    reused_from_evidence_id          TEXT,
+    started_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    completed_at                     DATETIME,
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    FOREIGN KEY (reused_from_evidence_id) REFERENCES build_setup_evidence(id) ON DELETE CASCADE,
+    CHECK (length(id) BETWEEN 1 AND 128),
+    CHECK (length(target_kind) BETWEEN 1 AND 100),
+    CHECK (length(CAST(target_key AS BLOB)) BETWEEN 1 AND 1000),
+    CHECK (length(CAST(target_workspace_path AS BLOB)) BETWEEN 1 AND 4096),
+    CHECK (workspace_evidence_state IN ('available', 'unavailable')),
+    CHECK ((workspace_evidence_state = 'available') = (workspace_evidence_fingerprint IS NOT NULL)),
+    CHECK (workspace_evidence_fingerprint IS NULL OR (length(workspace_evidence_fingerprint) = 64 AND workspace_evidence_fingerprint NOT GLOB '*[^0-9a-f]*')),
+    CHECK (length(setup_configuration_fingerprint) = 64 AND setup_configuration_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (provider IN ('host', 'docker_sandbox')),
+    CHECK ((provider = 'host') = (environment_revision IS NULL)),
+    CHECK (environment_revision IS NULL OR environment_revision >= 1),
+    CHECK (command_count >= 0),
+    CHECK (outcome IN ('running', 'completed', 'noop', 'reused', 'failed')),
+    CHECK ((outcome = 'reused') = (reused_from_evidence_id IS NOT NULL)),
+    CHECK ((outcome = 'running') = (completed_at IS NULL))
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_setup_evidence_active_target
+    ON build_setup_evidence(project_id, target_key)
+    WHERE outcome = 'running';
+
+  CREATE INDEX IF NOT EXISTS idx_build_setup_evidence_reuse
+    ON build_setup_evidence(
+      project_id, target_key, workspace_evidence_fingerprint,
+      setup_configuration_fingerprint, execution_profile_fingerprint,
+      provider, environment_revision, completed_at DESC
+    )
+    WHERE outcome IN ('completed', 'noop', 'reused');
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_setup_evidence_execution_run
+    ON build_setup_evidence(execution_run_id);
+
+  CREATE TRIGGER IF NOT EXISTS preserve_build_setup_evidence_identity
+  BEFORE UPDATE OF id, project_id, execution_run_id, target_kind, target_key,
+    target_workspace_path, workspace_evidence_state, workspace_evidence_fingerprint,
+    setup_configuration_fingerprint, execution_profile_fingerprint, provider,
+    environment_revision, command_count, reused_from_evidence_id, started_at
+    ON build_setup_evidence
+  BEGIN
+    SELECT RAISE(ABORT, 'Build setup evidence identity is immutable');
+  END;
+`);
+db.exec('DROP TRIGGER IF EXISTS preserve_execution_environment_identity');
+db.exec('DROP TRIGGER IF EXISTS validate_execution_environment_binding_identity');
+db.exec('DROP TRIGGER IF EXISTS preserve_execution_environment_binding_identity');
+db.exec(`
+  CREATE TRIGGER preserve_execution_environment_identity
+  BEFORE UPDATE OF id, project_id, provider_kind, provider_version, target_kind, target_key,
+    target_workspace_path, environment_revision, workspace_mode,
+    environment_validation_fingerprint, execution_profile_revision_id, execution_profile_fingerprint,
+    credential_requirements_fingerprint, template_identity, template_digest,
+    agent_identity, compatible_agents_json, created_at ON execution_environments
+  WHEN NEW.id <> OLD.id OR NEW.project_id <> OLD.project_id OR NEW.provider_kind <> OLD.provider_kind
+    OR NEW.provider_version <> OLD.provider_version OR NEW.target_kind <> OLD.target_kind
+    OR NEW.target_key <> OLD.target_key OR NEW.target_workspace_path <> OLD.target_workspace_path
+    OR NEW.environment_revision <> OLD.environment_revision OR NEW.workspace_mode <> OLD.workspace_mode
+    OR NEW.environment_validation_fingerprint <> OLD.environment_validation_fingerprint
+    OR NEW.execution_profile_revision_id IS NOT OLD.execution_profile_revision_id
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.credential_requirements_fingerprint IS NOT OLD.credential_requirements_fingerprint
+    OR NEW.template_identity IS NOT OLD.template_identity OR NEW.template_digest IS NOT OLD.template_digest
+    OR NEW.agent_identity IS NOT OLD.agent_identity OR NEW.compatible_agents_json <> OLD.compatible_agents_json
+    OR NEW.created_at <> OLD.created_at
+  BEGIN SELECT RAISE(ABORT, 'Execution environment identity is immutable'); END;
+
+  CREATE TRIGGER validate_execution_environment_binding_identity
+  BEFORE INSERT ON execution_environment_run_bindings
+  WHEN NOT EXISTS (
+    SELECT 1 FROM execution_environments WHERE id = NEW.environment_id AND project_id = NEW.project_id
+      AND environment_revision = NEW.environment_revision
+      AND environment_validation_fingerprint = NEW.environment_validation_fingerprint
+      AND execution_profile_fingerprint IS NEW.execution_profile_fingerprint
+  )
+  BEGIN SELECT RAISE(ABORT, 'Execution environment binding identity does not match'); END;
+
+  CREATE TRIGGER preserve_execution_environment_binding_identity
+  BEFORE UPDATE OF environment_id, execution_run_id, project_id, relationship,
+    environment_revision, environment_validation_fingerprint, execution_profile_fingerprint, bound_at
+    ON execution_environment_run_bindings
+  WHEN NEW.environment_id <> OLD.environment_id OR NEW.execution_run_id <> OLD.execution_run_id
+    OR NEW.project_id <> OLD.project_id OR NEW.relationship <> OLD.relationship
+    OR NEW.environment_revision <> OLD.environment_revision
+    OR NEW.environment_validation_fingerprint <> OLD.environment_validation_fingerprint
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.bound_at <> OLD.bound_at
+  BEGIN SELECT RAISE(ABORT, 'Execution environment run binding identity is immutable'); END;
+`);
 db.exec('DROP TRIGGER IF EXISTS validate_execution_environment_binding_authority');
 db.exec(`
   CREATE TRIGGER IF NOT EXISTS validate_project_build_execution_provider_insert
@@ -2344,7 +2768,8 @@ db.exec(`
     SELECT RAISE(ABORT, 'Execution environment binding evidence is immutable');
   END;
 `);
-db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_reuse ON execution_environments(project_id, provider_kind, target_key, target_workspace_path, environment_revision, workspace_mode, environment_validation_fingerprint, lifecycle_state)');
+db.exec('DROP INDEX IF EXISTS idx_execution_environments_reuse');
+db.exec('CREATE INDEX idx_execution_environments_reuse ON execution_environments(project_id, provider_kind, target_key, target_workspace_path, environment_revision, workspace_mode, environment_validation_fingerprint, execution_profile_fingerprint, credential_requirements_fingerprint, retirement_requested_at, lifecycle_state)');
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_execution_environments_external_id ON execution_environments(provider_kind, external_id) WHERE external_id IS NOT NULL');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_cleanup ON execution_environments(lifecycle_state, cleanup_claim_id, updated_at, cleanup_attempts)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environment_events_sequence ON execution_environment_events(project_id, environment_id, sequence)');
@@ -4327,6 +4752,11 @@ db.exec('CREATE INDEX IF NOT EXISTS idx_project_links_linked_project_id ON proje
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequences_project_status ON build_sequences(project_id, status)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequences_bundle_status ON build_sequences(worktree_bundle_id, status)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequence_tickets_sequence_position ON build_sequence_tickets(build_sequence_id, position)');
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_sequence_tickets_activation_run
+  ON build_sequence_tickets(activation_execution_run_id)
+  WHERE activation_execution_run_id IS NOT NULL
+`);
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_connections_provider_project ON integration_connections(provider, project_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_tickets_external_key ON tickets(external_provider, external_key)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_bundle_automation_state_project_bundle ON bundle_automation_state(project_id, worktree_bundle_id)');