@straiffi/archon 1.8.20 → 1.8.22

package/dist/server/db.js

@@ -3,6 +3,7 @@ import { createHash } from 'crypto';
 import { parseCheckDefinitionsJsonStrict, parseLegacyTestCommandsJsonStrict, projectCheckDefinitionsToTestCommands, } from './lib/checkDefinitions.js';
 import { ensureParentDirectory, resolveArchonDbPath } from './lib/runtimePaths.js';
 import { TRANSCRIPT_RUN_TEXT_LIMIT_BYTES, truncateUtf8 } from './lib/transcriptRuns.js';
+import { createExecutionProfile, EXECUTION_PROFILE_SCHEMA_VERSION, fingerprintExecutionProfile, normalizeExecutionProfile, serializeExecutionProfile, } from './lib/executionProfiles.js';
 const dbPath = ensureParentDirectory(resolveArchonDbPath());
 const db = new Database(dbPath);
 db.pragma('foreign_keys = ON');
@@ -55,6 +56,7 @@ db.exec(`
     name         TEXT NOT NULL,
     repo_path    TEXT NOT NULL,
     build_execution_provider TEXT NOT NULL DEFAULT 'host' CHECK (build_execution_provider IN ('host', 'docker_sandbox')),
+    active_execution_profile_revision_id TEXT NOT NULL DEFAULT '',
     active_target_kind TEXT NOT NULL DEFAULT 'repo_root',
     active_target_bundle_id TEXT,
     worktree_cmd TEXT,
@@ -148,6 +150,7 @@ db.exec('UPDATE worktree_bundles SET required_check_policy_override = NULL WHERE
 ensureColumn('projects', 'worktree_sync', 'TEXT');
 ensureColumn('projects', 'build_execution_provider', "TEXT NOT NULL DEFAULT 'host'");
 db.exec("UPDATE projects SET build_execution_provider = 'host' WHERE build_execution_provider IS NULL OR build_execution_provider NOT IN ('host', 'docker_sandbox')");
+ensureColumn('projects', 'active_execution_profile_revision_id', "TEXT NOT NULL DEFAULT ''");
 ensureColumn('projects', 'active_target_kind', "TEXT NOT NULL DEFAULT 'repo_root'");
 ensureColumn('projects', 'active_target_bundle_id', 'TEXT');
 ensureColumn('projects', 'check_definitions', 'TEXT');
@@ -173,6 +176,278 @@ ensureColumn('projects', 'spec_aware_code_review_enabled', 'INTEGER NOT NULL DEF
 ensureColumn('projects', 'deletion_started_at', 'DATETIME');
 ensureColumn('projects', 'deletion_claim_id', 'TEXT');
 ensureColumn('projects', 'deletion_cleanup_started_at', 'DATETIME');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS execution_profile_revisions (
+    id             TEXT PRIMARY KEY,
+    project_id     TEXT NOT NULL,
+    revision       INTEGER NOT NULL CHECK (revision > 0),
+    schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2)),
+    fingerprint    TEXT NOT NULL CHECK (length(fingerprint) = 64),
+    profile_json   TEXT NOT NULL CHECK (
+      json_valid(profile_json)
+      AND json_type(profile_json) = 'object'
+      AND length(CAST(profile_json AS BLOB)) BETWEEN 2 AND 16384
+    ),
+    created_at     DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (project_id, revision),
+    UNIQUE (project_id, fingerprint),
+    UNIQUE (project_id, id),
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+  );
+
+  CREATE TABLE IF NOT EXISTS execution_profile_audit_events (
+    id                           TEXT PRIMARY KEY,
+    project_id                   TEXT NOT NULL,
+    event_type                   TEXT NOT NULL CHECK (event_type IN ('revision_created', 'revision_activated')),
+    profile_revision_id          TEXT NOT NULL,
+    previous_profile_revision_id TEXT,
+    metadata_json                TEXT CHECK (
+      metadata_json IS NULL OR (
+        json_valid(metadata_json)
+        AND json_type(metadata_json) = 'object'
+        AND length(CAST(metadata_json AS BLOB)) BETWEEN 2 AND 16384
+      )
+    ),
+    created_at                   DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (project_id, profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id, previous_profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE CASCADE
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_execution_profile_revisions_project
+    ON execution_profile_revisions(project_id, revision DESC);
+  CREATE INDEX IF NOT EXISTS idx_execution_profile_audit_project
+    ON execution_profile_audit_events(project_id, created_at DESC, id DESC);
+`);
+const executionProfileRevisionsTableSql = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'execution_profile_revisions'").get()?.sql ?? '';
+if (!executionProfileRevisionsTableSql.includes('schema_version IN (1, 2)')) {
+    db.pragma('foreign_keys = OFF');
+    db.transaction(() => {
+        const referencingTriggers = db.prepare(`
+      SELECT name FROM sqlite_master
+      WHERE type = 'trigger' AND instr(sql, 'execution_profile_revisions') > 0
+    `).all();
+        for (const trigger of referencingTriggers) {
+            db.exec(`DROP TRIGGER IF EXISTS "${trigger.name.replaceAll('"', '""')}"`);
+        }
+        db.exec(`
+      CREATE TABLE execution_profile_revisions_v2 (
+        id             TEXT PRIMARY KEY,
+        project_id     TEXT NOT NULL,
+        revision       INTEGER NOT NULL CHECK (revision > 0),
+        schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2)),
+        fingerprint    TEXT NOT NULL CHECK (length(fingerprint) = 64),
+        profile_json   TEXT NOT NULL CHECK (
+          json_valid(profile_json)
+          AND json_type(profile_json) = 'object'
+          AND length(CAST(profile_json AS BLOB)) BETWEEN 2 AND 16384
+        ),
+        created_at     DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE (project_id, revision),
+        UNIQUE (project_id, fingerprint),
+        UNIQUE (project_id, id),
+        FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+      );
+      INSERT INTO execution_profile_revisions_v2 (
+        id, project_id, revision, schema_version, fingerprint, profile_json, created_at
+      )
+      SELECT id, project_id, revision, schema_version, fingerprint, profile_json, created_at
+      FROM execution_profile_revisions;
+      DROP TABLE execution_profile_revisions;
+      ALTER TABLE execution_profile_revisions_v2 RENAME TO execution_profile_revisions;
+    `);
+    })();
+    db.pragma('foreign_keys = ON');
+}
+const backfillExecutionProfiles = () => {
+    const projects = db.prepare(`
+    SELECT id, build_execution_provider, active_execution_profile_revision_id
+    FROM projects
+  `).all();
+    const findOwnedRevision = db.prepare(`
+    SELECT 1 FROM execution_profile_revisions WHERE project_id = ? AND id = ?
+  `);
+    const insertRevision = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (?, ?, 1, ${EXECUTION_PROFILE_SCHEMA_VERSION}, ?, ?)
+  `);
+    const activateRevision = db.prepare(`
+    UPDATE projects SET active_execution_profile_revision_id = ? WHERE id = ?
+  `);
+    const insertEvent = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (?, ?, 'revision_created', ?, NULL)
+  `);
+    db.transaction(() => {
+        for (const project of projects) {
+            if (project.active_execution_profile_revision_id
+                && findOwnedRevision.get(project.id, project.active_execution_profile_revision_id)) {
+                continue;
+            }
+            const profile = createExecutionProfile(project.build_execution_provider);
+            const profileJson = serializeExecutionProfile(profile);
+            const fingerprint = fingerprintExecutionProfile(profile);
+            const revisionId = `${project.id}:execution-profile:1`;
+            insertRevision.run(revisionId, project.id, fingerprint, profileJson);
+            activateRevision.run(revisionId, project.id);
+            insertEvent.run(`${revisionId}:created`, project.id, revisionId);
+        }
+    })();
+};
+const backfillExecutionProfilesToSchemaV2 = () => {
+    const legacyRows = db.prepare(`
+    SELECT projects.id AS project_id,
+      revisions.id AS revision_id,
+      revisions.profile_json
+    FROM projects
+    INNER JOIN execution_profile_revisions revisions
+      ON revisions.id = projects.active_execution_profile_revision_id
+      AND revisions.project_id = projects.id
+    WHERE revisions.schema_version = 1 AND projects.deletion_started_at IS NULL
+  `).all();
+    const nextRevisionNumber = db.prepare(`
+    SELECT COALESCE(MAX(revision), 0) + 1 AS revision
+    FROM execution_profile_revisions WHERE project_id = ?
+  `);
+    const findRevisionByFingerprint = db.prepare(`
+    SELECT id FROM execution_profile_revisions WHERE project_id = ? AND fingerprint = ?
+  `);
+    const insertRevision = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (?, ?, ?, ${EXECUTION_PROFILE_SCHEMA_VERSION}, ?, ?)
+  `);
+    const activateRevision = db.prepare(`
+    UPDATE projects SET active_execution_profile_revision_id = ?
+    WHERE id = ? AND active_execution_profile_revision_id = ?
+  `);
+    const insertEvent = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (?, ?, 'revision_activated', ?, ?)
+  `);
+    db.transaction(() => {
+        for (const row of legacyRows) {
+            let normalized;
+            try {
+                normalized = normalizeExecutionProfile(JSON.parse(row.profile_json));
+            }
+            catch {
+                normalized = null;
+            }
+            if (!normalized?.ok) {
+                throw new Error(`Stored execution profile revision ${row.revision_id} is invalid`);
+            }
+            const fingerprint = fingerprintExecutionProfile(normalized.profile);
+            const existing = findRevisionByFingerprint.get(row.project_id, fingerprint);
+            let revisionId;
+            if (existing) {
+                revisionId = existing.id;
+            }
+            else {
+                revisionId = `${row.project_id}:execution-profile:v2`;
+                const revisionNumber = nextRevisionNumber.get(row.project_id).revision;
+                insertRevision.run(revisionId, row.project_id, revisionNumber, fingerprint, serializeExecutionProfile(normalized.profile));
+            }
+            const activated = activateRevision.run(revisionId, row.project_id, row.revision_id);
+            if (activated.changes > 0) {
+                insertEvent.run(`${revisionId}:v2-backfill`, row.project_id, revisionId, row.revision_id);
+            }
+        }
+    })();
+};
+backfillExecutionProfiles();
+backfillExecutionProfilesToSchemaV2();
+const hostCompatibilityProfile = createExecutionProfile('host');
+const hostCompatibilityProfileJson = serializeExecutionProfile(hostCompatibilityProfile).replaceAll("'", "''");
+const hostCompatibilityFingerprint = fingerprintExecutionProfile(hostCompatibilityProfile);
+const dockerProfile = createExecutionProfile('docker_sandbox');
+const dockerProfileJson = serializeExecutionProfile(dockerProfile).replaceAll("'", "''");
+const dockerProfileFingerprint = fingerprintExecutionProfile(dockerProfile);
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS create_project_execution_profile
+  AFTER INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id = ''
+  BEGIN
+    INSERT INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (
+      NEW.id || ':execution-profile:1', NEW.id, 1, ${EXECUTION_PROFILE_SCHEMA_VERSION},
+      CASE WHEN NEW.build_execution_provider = 'docker_sandbox'
+        THEN '${dockerProfileFingerprint}' ELSE '${hostCompatibilityFingerprint}' END,
+      CASE WHEN NEW.build_execution_provider = 'docker_sandbox'
+        THEN '${dockerProfileJson}' ELSE '${hostCompatibilityProfileJson}' END
+    );
+    UPDATE projects
+    SET active_execution_profile_revision_id = NEW.id || ':execution-profile:1'
+    WHERE id = NEW.id;
+    INSERT INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (
+      NEW.id || ':execution-profile:1:created', NEW.id, 'revision_created',
+      NEW.id || ':execution-profile:1', NULL
+    );
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_owner_insert
+  BEFORE INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id <> '' AND NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id AND id = NEW.active_execution_profile_revision_id
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Active execution profile revision is not owned by project');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_owner_update
+  BEFORE UPDATE OF active_execution_profile_revision_id ON projects
+  WHEN NEW.active_execution_profile_revision_id = '' OR NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id AND id = NEW.active_execution_profile_revision_id
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Active execution profile revision is not owned by project');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_projection_insert
+  BEFORE INSERT ON projects
+  WHEN NEW.active_execution_profile_revision_id <> '' AND NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id
+      AND id = NEW.active_execution_profile_revision_id
+      AND json_extract(profile_json, '$.provider_preference') = NEW.build_execution_provider
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Build execution provider must project the active execution profile');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_project_execution_profile_projection_update
+  BEFORE UPDATE OF active_execution_profile_revision_id, build_execution_provider ON projects
+  WHEN NOT EXISTS (
+    SELECT 1 FROM execution_profile_revisions
+    WHERE project_id = NEW.id
+      AND id = NEW.active_execution_profile_revision_id
+      AND json_extract(profile_json, '$.provider_preference') = NEW.build_execution_provider
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Build execution provider must project the active execution profile');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_profile_revision
+  BEFORE UPDATE ON execution_profile_revisions
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution profile revisions are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_profile_audit_event
+  BEFORE UPDATE ON execution_profile_audit_events
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution profile audit events are immutable');
+  END;
+`);
 const backfillProjectCheckDefinitions = () => {
     const rows = db.prepare(`
     SELECT id, check_definitions, test_commands
@@ -946,11 +1221,115 @@ db.exec(`
     entered_queue_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
     started_at        DATETIME,
     finished_at       DATETIME,
+    execution_profile_revision_id TEXT,
+    execution_profile_fingerprint TEXT,
+    execution_profile_selection_reason TEXT,
+    activation_execution_run_id TEXT,
     PRIMARY KEY (build_sequence_id, ticket_id),
     FOREIGN KEY (build_sequence_id) REFERENCES build_sequences(id) ON DELETE CASCADE,
     FOREIGN KEY (ticket_id) REFERENCES tickets(id) ON DELETE CASCADE
   )
 `);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS build_sequence_ticket_replacements (
+    id                                 TEXT PRIMARY KEY,
+    build_sequence_id                  TEXT NOT NULL,
+    ticket_id                          TEXT NOT NULL,
+    position                           INTEGER NOT NULL,
+    execution_profile_revision_id      TEXT NOT NULL,
+    execution_profile_fingerprint      TEXT NOT NULL,
+    execution_profile_selection_reason TEXT NOT NULL,
+    replaced_at                        DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (build_sequence_id) REFERENCES build_sequences(id) ON DELETE CASCADE,
+    FOREIGN KEY (ticket_id) REFERENCES tickets(id) ON DELETE CASCADE
+  )
+`);
+ensureColumn('build_sequence_tickets', 'execution_profile_revision_id', 'TEXT');
+ensureColumn('build_sequence_tickets', 'execution_profile_fingerprint', 'TEXT');
+ensureColumn('build_sequence_tickets', 'execution_profile_selection_reason', 'TEXT');
+ensureColumn('build_sequence_tickets', 'activation_execution_run_id', 'TEXT');
+db.transaction(() => {
+    const incompleteSequenceIds = db.prepare(`
+    SELECT DISTINCT build_sequence_id
+    FROM build_sequence_tickets
+    WHERE status IN ('active', 'queued')
+      AND (
+        execution_profile_revision_id IS NULL
+        OR execution_profile_fingerprint IS NULL
+        OR execution_profile_selection_reason IS NULL
+      )
+  `).all();
+    const failActive = db.prepare(`
+    UPDATE build_sequence_tickets
+    SET status = 'failed', finished_at = COALESCE(finished_at, CURRENT_TIMESTAMP)
+    WHERE build_sequence_id = ? AND status = 'active'
+  `);
+    const cancelQueued = db.prepare(`
+    UPDATE build_sequence_tickets
+    SET status = 'cancelled', finished_at = COALESCE(finished_at, CURRENT_TIMESTAMP)
+    WHERE build_sequence_id = ? AND status = 'queued'
+  `);
+    const failSequence = db.prepare(`
+    UPDATE build_sequences SET status = 'failed', updated_at = CURRENT_TIMESTAMP
+    WHERE id = ? AND status = 'active'
+  `);
+    for (const row of incompleteSequenceIds) {
+        failActive.run(row.build_sequence_id);
+        cancelQueued.run(row.build_sequence_id);
+        failSequence.run(row.build_sequence_id);
+    }
+})();
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS validate_build_sequence_ticket_profile_insert
+  BEFORE INSERT ON build_sequence_tickets
+  WHEN NEW.status IN ('active', 'queued')
+    OR NEW.execution_profile_revision_id IS NOT NULL OR NEW.execution_profile_fingerprint IS NOT NULL
+    OR NEW.execution_profile_selection_reason IS NOT NULL
+  BEGIN
+    SELECT CASE WHEN
+      NEW.execution_profile_revision_id IS NULL
+      OR NEW.execution_profile_fingerprint IS NULL
+      OR NEW.execution_profile_selection_reason NOT IN ('project_active_at_acceptance', 'historical_lineage')
+      OR NOT EXISTS (
+        SELECT 1
+        FROM execution_profile_revisions revision
+        JOIN build_sequences sequence ON sequence.id = NEW.build_sequence_id
+        WHERE revision.id = NEW.execution_profile_revision_id
+          AND revision.project_id = sequence.project_id
+          AND revision.fingerprint = NEW.execution_profile_fingerprint
+      )
+    THEN RAISE(ABORT, 'Invalid Build sequence execution profile selection') END;
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_build_sequence_ticket_profile_activation
+  BEFORE UPDATE OF status ON build_sequence_tickets
+  WHEN NEW.status IN ('active', 'queued') AND (
+    NEW.execution_profile_revision_id IS NULL
+    OR NEW.execution_profile_fingerprint IS NULL
+    OR NEW.execution_profile_selection_reason NOT IN ('project_active_at_acceptance', 'historical_lineage')
+    OR NOT EXISTS (
+      SELECT 1
+      FROM execution_profile_revisions revision
+      JOIN build_sequences sequence ON sequence.id = NEW.build_sequence_id
+      WHERE revision.id = NEW.execution_profile_revision_id
+        AND revision.project_id = sequence.project_id
+        AND revision.fingerprint = NEW.execution_profile_fingerprint
+    )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid Build sequence execution profile selection');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_build_sequence_ticket_profile
+  BEFORE UPDATE OF execution_profile_revision_id, execution_profile_fingerprint, execution_profile_selection_reason
+  ON build_sequence_tickets
+  WHEN NEW.execution_profile_revision_id IS NOT OLD.execution_profile_revision_id
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.execution_profile_selection_reason IS NOT OLD.execution_profile_selection_reason
+  BEGIN
+    SELECT RAISE(ABORT, 'Build sequence execution profile selection is immutable');
+  END;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS ticket_dependencies (
     blocker_ticket_id   TEXT NOT NULL,
@@ -2132,6 +2511,9 @@ db.exec(`
     environment_revision                INTEGER NOT NULL,
     workspace_mode                      TEXT NOT NULL,
     environment_validation_fingerprint  TEXT NOT NULL,
+    execution_profile_revision_id       TEXT,
+    execution_profile_fingerprint       TEXT,
+    credential_requirements_fingerprint TEXT,
     template_identity                   TEXT,
     template_digest                     TEXT,
     agent_identity                      TEXT,
@@ -2151,6 +2533,7 @@ db.exec(`
     last_used_at                        DATETIME,
     stopped_at                          DATETIME,
     retirement_started_at               DATETIME,
+    retirement_requested_at             DATETIME,
     cleanup_pending_at                  DATETIME,
     retired_at                          DATETIME,
     failed_at                           DATETIME,
@@ -2169,6 +2552,10 @@ db.exec(`
     CHECK (environment_revision >= 1),
     CHECK (workspace_mode = 'direct'),
     CHECK (length(environment_validation_fingerprint) = 64 AND environment_validation_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK ((execution_profile_revision_id IS NULL) = (execution_profile_fingerprint IS NULL)),
+    CHECK ((execution_profile_fingerprint IS NULL) = (credential_requirements_fingerprint IS NULL)),
+    CHECK (execution_profile_fingerprint IS NULL OR (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*')),
+    CHECK (credential_requirements_fingerprint IS NULL OR (length(credential_requirements_fingerprint) = 64 AND credential_requirements_fingerprint NOT GLOB '*[^0-9a-f]*')),
     CHECK ((template_identity IS NULL) <> (template_digest IS NULL)),
     CHECK (template_identity IS NULL OR length(CAST(template_identity AS BLOB)) BETWEEN 1 AND 500),
     CHECK (template_digest IS NULL OR length(CAST(template_digest AS BLOB)) BETWEEN 1 AND 500),
@@ -2214,6 +2601,7 @@ db.exec(`
     relationship                        TEXT NOT NULL,
     environment_revision                INTEGER NOT NULL,
     environment_validation_fingerprint  TEXT NOT NULL,
+    execution_profile_fingerprint       TEXT,
     authority_json                      TEXT,
     placement_json                      TEXT,
     bound_at                            DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -2224,6 +2612,7 @@ db.exec(`
     CHECK (relationship IN ('validation', 'execution')),
     CHECK (environment_revision >= 1),
     CHECK (length(environment_validation_fingerprint) = 64 AND environment_validation_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (execution_profile_fingerprint IS NULL OR (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*')),
     CHECK (relationship <> 'execution' OR length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384),
     CHECK (placement_json IS NULL OR (relationship = 'execution' AND length(CAST(placement_json AS BLOB)) BETWEEN 2 AND 16384))
   );
@@ -2298,8 +2687,357 @@ db.exec(`
     SELECT RAISE(ABORT, 'Execution environment run binding identity is immutable');
   END;
 `);
+ensureColumn('execution_environments', 'execution_profile_revision_id', 'TEXT');
+ensureColumn('execution_environments', 'execution_profile_fingerprint', 'TEXT');
+ensureColumn('execution_environments', 'credential_requirements_fingerprint', 'TEXT');
+ensureColumn('execution_environments', 'retirement_requested_at', 'DATETIME');
+ensureColumn('execution_environment_run_bindings', 'execution_profile_fingerprint', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'authority_json', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'placement_json', 'TEXT');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS execution_run_authorities (
+    execution_run_id                 TEXT NOT NULL,
+    project_id                       TEXT NOT NULL,
+    execution_profile_revision_id    TEXT NOT NULL,
+    execution_profile_fingerprint    TEXT NOT NULL,
+    authority_json                   TEXT NOT NULL,
+    created_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (execution_run_id),
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id, execution_profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE RESTRICT,
+    CHECK (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS preserve_execution_run_authority
+  BEFORE UPDATE ON execution_run_authorities
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution run authority is immutable');
+  END;
+
+`);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS approval_requests (
+    id                        TEXT PRIMARY KEY,
+    project_id                TEXT NOT NULL,
+    execution_run_id          TEXT NOT NULL,
+    action_kind               TEXT NOT NULL,
+    action_schema_version     INTEGER NOT NULL,
+    action_json               TEXT NOT NULL,
+    action_fingerprint        TEXT NOT NULL,
+    authority_schema_version  INTEGER NOT NULL,
+    authority_json            TEXT NOT NULL,
+    status                    TEXT NOT NULL DEFAULT 'pending',
+    expires_at                DATETIME NOT NULL,
+    decision_at               DATETIME,
+    consumed_at               DATETIME,
+    created_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (id, project_id),
+    UNIQUE (execution_run_id),
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    CHECK (length(id) BETWEEN 1 AND 128),
+    CHECK (action_kind IN ('git_push', 'custom_check')),
+    CHECK (action_schema_version = 1),
+    CHECK (length(CAST(action_json AS BLOB)) BETWEEN 2 AND 65536),
+    CHECK (length(action_fingerprint) = 64 AND action_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (authority_schema_version = 1),
+    CHECK (length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384),
+    CHECK (status IN ('pending', 'approved', 'denied', 'cancelled', 'expired', 'invalidated', 'consumed')),
+    CHECK (status NOT IN ('approved', 'denied', 'consumed') OR decision_at IS NOT NULL),
+    CHECK (status <> 'pending' OR decision_at IS NULL),
+    CHECK ((status = 'consumed') = (consumed_at IS NOT NULL))
+  );
+
+  CREATE TABLE IF NOT EXISTS approval_request_events (
+    id                    TEXT PRIMARY KEY,
+    project_id            TEXT NOT NULL,
+    approval_request_id   TEXT NOT NULL,
+    sequence              INTEGER NOT NULL,
+    event_type            TEXT NOT NULL,
+    from_status           TEXT,
+    to_status             TEXT NOT NULL,
+    actor_classification  TEXT NOT NULL,
+    actor_reference       TEXT,
+    reason                TEXT,
+    metadata_schema_version INTEGER NOT NULL DEFAULT 1,
+    metadata_json         TEXT,
+    created_at            DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (approval_request_id, sequence),
+    FOREIGN KEY (approval_request_id, project_id) REFERENCES approval_requests(id, project_id) ON DELETE CASCADE,
+    CHECK (sequence >= 1),
+    CHECK (length(event_type) BETWEEN 1 AND 100),
+    CHECK (from_status IS NULL OR from_status IN ('pending', 'approved', 'denied', 'cancelled', 'expired', 'invalidated', 'consumed')),
+    CHECK (to_status IN ('pending', 'approved', 'denied', 'cancelled', 'expired', 'invalidated', 'consumed')),
+    CHECK (actor_classification IN ('human', 'system', 'action_executor')),
+    CHECK (actor_reference IS NULL OR length(CAST(actor_reference AS BLOB)) BETWEEN 1 AND 200),
+    CHECK (reason IS NULL OR length(CAST(reason AS BLOB)) <= 2000),
+    CHECK (metadata_schema_version = 1),
+    CHECK (metadata_json IS NULL OR length(CAST(metadata_json AS BLOB)) <= 4096)
+  );
+
+  CREATE TRIGGER IF NOT EXISTS preserve_approval_request_identity
+  BEFORE UPDATE OF id, project_id, execution_run_id, action_kind, action_schema_version,
+    action_json, action_fingerprint, authority_schema_version, authority_json, expires_at, created_at
+    ON approval_requests
+  BEGIN
+    SELECT RAISE(ABORT, 'Approval request identity and evidence are immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_approval_request_decision_evidence
+  BEFORE UPDATE OF decision_at, consumed_at ON approval_requests
+  WHEN (OLD.decision_at IS NOT NULL AND NEW.decision_at IS NOT OLD.decision_at)
+    OR (OLD.consumed_at IS NOT NULL AND NEW.consumed_at IS NOT OLD.consumed_at)
+  BEGIN
+    SELECT RAISE(ABORT, 'Approval request decision evidence is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_approval_request_status_transition
+  BEFORE UPDATE OF status ON approval_requests
+  WHEN NOT (
+    (OLD.status = 'pending' AND NEW.status IN ('approved', 'denied', 'cancelled', 'expired', 'invalidated'))
+    OR (OLD.status = 'approved' AND NEW.status IN ('consumed', 'expired', 'invalidated'))
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid approval request status transition');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_approval_request_events
+  BEFORE UPDATE ON approval_request_events
+  BEGIN
+    SELECT RAISE(ABORT, 'Approval request events are append-only');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS prevent_approval_request_event_deletion
+  BEFORE DELETE ON approval_request_events
+  WHEN EXISTS (
+    SELECT 1 FROM projects
+    WHERE id = OLD.project_id AND deletion_started_at IS NULL
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Approval request events are append-only');
+  END;
+
+  CREATE INDEX IF NOT EXISTS idx_approval_requests_project_created
+    ON approval_requests(project_id, created_at DESC, id DESC);
+  CREATE INDEX IF NOT EXISTS idx_approval_requests_project_status_expiry
+    ON approval_requests(project_id, status, expires_at, id);
+  CREATE INDEX IF NOT EXISTS idx_approval_requests_action_kind
+    ON approval_requests(project_id, action_kind, created_at DESC, id DESC);
+  CREATE INDEX IF NOT EXISTS idx_approval_request_events_sequence
+    ON approval_request_events(project_id, approval_request_id, sequence ASC);
+`);
+const migrateApprovalRequestActionLimit = () => {
+    const tableSql = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'approval_requests'").get()?.sql ?? '';
+    if (tableSql.includes('BETWEEN 2 AND 65536')) {
+        return;
+    }
+    db.exec('PRAGMA foreign_keys = OFF');
+    try {
+        db.exec('BEGIN');
+        db.exec(`
+      CREATE TABLE approval_requests_v2 (
+        id                        TEXT PRIMARY KEY,
+        project_id                TEXT NOT NULL,
+        execution_run_id          TEXT NOT NULL,
+        action_kind               TEXT NOT NULL,
+        action_schema_version     INTEGER NOT NULL,
+        action_json               TEXT NOT NULL,
+        action_fingerprint        TEXT NOT NULL,
+        authority_schema_version  INTEGER NOT NULL,
+        authority_json            TEXT NOT NULL,
+        status                    TEXT NOT NULL DEFAULT 'pending',
+        expires_at                DATETIME NOT NULL,
+        decision_at               DATETIME,
+        consumed_at               DATETIME,
+        created_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE (id, project_id),
+        UNIQUE (execution_run_id),
+        FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+        FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+        CHECK (length(id) BETWEEN 1 AND 128),
+        CHECK (action_kind IN ('git_push', 'custom_check')),
+        CHECK (action_schema_version = 1),
+        CHECK (length(CAST(action_json AS BLOB)) BETWEEN 2 AND 65536),
+        CHECK (length(action_fingerprint) = 64 AND action_fingerprint NOT GLOB '*[^0-9a-f]*'),
+        CHECK (authority_schema_version = 1),
+        CHECK (length(CAST(authority_json AS BLOB)) BETWEEN 2 AND 16384),
+        CHECK (status IN ('pending', 'approved', 'denied', 'cancelled', 'expired', 'invalidated', 'consumed')),
+        CHECK (status NOT IN ('approved', 'denied', 'consumed') OR decision_at IS NOT NULL),
+        CHECK (status <> 'pending' OR decision_at IS NULL),
+        CHECK ((status = 'consumed') = (consumed_at IS NOT NULL))
+      );
+      INSERT INTO approval_requests_v2 (
+        id, project_id, execution_run_id, action_kind, action_schema_version, action_json,
+        action_fingerprint, authority_schema_version, authority_json, status, expires_at,
+        decision_at, consumed_at, created_at, updated_at
+      )
+      SELECT
+        id, project_id, execution_run_id, action_kind, action_schema_version, action_json,
+        action_fingerprint, authority_schema_version, authority_json, status, expires_at,
+        decision_at, consumed_at, created_at, updated_at
+      FROM approval_requests;
+      DROP TABLE approval_requests;
+      ALTER TABLE approval_requests_v2 RENAME TO approval_requests;
+    `);
+        db.exec('COMMIT');
+    }
+    catch (error) {
+        db.exec('ROLLBACK');
+        throw error;
+    }
+    finally {
+        db.exec('PRAGMA foreign_keys = ON');
+    }
+    db.exec(`
+    CREATE TRIGGER preserve_approval_request_identity
+    BEFORE UPDATE OF id, project_id, execution_run_id, action_kind, action_schema_version,
+      action_json, action_fingerprint, authority_schema_version, authority_json, expires_at, created_at
+      ON approval_requests
+    BEGIN
+      SELECT RAISE(ABORT, 'Approval request identity and evidence are immutable');
+    END;
+
+    CREATE TRIGGER preserve_approval_request_decision_evidence
+    BEFORE UPDATE OF decision_at, consumed_at ON approval_requests
+    WHEN (OLD.decision_at IS NOT NULL AND NEW.decision_at IS NOT OLD.decision_at)
+      OR (OLD.consumed_at IS NOT NULL AND NEW.consumed_at IS NOT OLD.consumed_at)
+    BEGIN
+      SELECT RAISE(ABORT, 'Approval request decision evidence is immutable');
+    END;
+
+    CREATE TRIGGER validate_approval_request_status_transition
+    BEFORE UPDATE OF status ON approval_requests
+    WHEN NOT (
+      (OLD.status = 'pending' AND NEW.status IN ('approved', 'denied', 'cancelled', 'expired', 'invalidated'))
+      OR (OLD.status = 'approved' AND NEW.status IN ('consumed', 'expired', 'invalidated'))
+    )
+    BEGIN
+      SELECT RAISE(ABORT, 'Invalid approval request status transition');
+    END;
+
+    CREATE INDEX idx_approval_requests_project_created
+      ON approval_requests(project_id, created_at DESC, id DESC);
+    CREATE INDEX idx_approval_requests_project_status_expiry
+      ON approval_requests(project_id, status, expires_at, id);
+    CREATE INDEX idx_approval_requests_action_kind
+      ON approval_requests(project_id, action_kind, created_at DESC, id DESC);
+  `);
+};
+migrateApprovalRequestActionLimit();
+db.exec(`
+  CREATE TABLE IF NOT EXISTS build_setup_evidence (
+    id                              TEXT PRIMARY KEY,
+    project_id                      TEXT NOT NULL,
+    execution_run_id                TEXT NOT NULL,
+    target_kind                     TEXT NOT NULL,
+    target_key                      TEXT NOT NULL,
+    target_workspace_path           TEXT NOT NULL,
+    workspace_evidence_state        TEXT NOT NULL,
+    workspace_evidence_fingerprint  TEXT,
+    setup_configuration_fingerprint TEXT NOT NULL,
+    execution_profile_fingerprint   TEXT NOT NULL,
+    provider                        TEXT NOT NULL,
+    environment_revision            INTEGER,
+    command_count                    INTEGER NOT NULL,
+    outcome                          TEXT NOT NULL,
+    reused_from_evidence_id          TEXT,
+    started_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    completed_at                     DATETIME,
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    FOREIGN KEY (reused_from_evidence_id) REFERENCES build_setup_evidence(id) ON DELETE CASCADE,
+    CHECK (length(id) BETWEEN 1 AND 128),
+    CHECK (length(target_kind) BETWEEN 1 AND 100),
+    CHECK (length(CAST(target_key AS BLOB)) BETWEEN 1 AND 1000),
+    CHECK (length(CAST(target_workspace_path AS BLOB)) BETWEEN 1 AND 4096),
+    CHECK (workspace_evidence_state IN ('available', 'unavailable')),
+    CHECK ((workspace_evidence_state = 'available') = (workspace_evidence_fingerprint IS NOT NULL)),
+    CHECK (workspace_evidence_fingerprint IS NULL OR (length(workspace_evidence_fingerprint) = 64 AND workspace_evidence_fingerprint NOT GLOB '*[^0-9a-f]*')),
+    CHECK (length(setup_configuration_fingerprint) = 64 AND setup_configuration_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (provider IN ('host', 'docker_sandbox')),
+    CHECK ((provider = 'host') = (environment_revision IS NULL)),
+    CHECK (environment_revision IS NULL OR environment_revision >= 1),
+    CHECK (command_count >= 0),
+    CHECK (outcome IN ('running', 'completed', 'noop', 'reused', 'failed')),
+    CHECK ((outcome = 'reused') = (reused_from_evidence_id IS NOT NULL)),
+    CHECK ((outcome = 'running') = (completed_at IS NULL))
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_setup_evidence_active_target
+    ON build_setup_evidence(project_id, target_key)
+    WHERE outcome = 'running';
+
+  CREATE INDEX IF NOT EXISTS idx_build_setup_evidence_reuse
+    ON build_setup_evidence(
+      project_id, target_key, workspace_evidence_fingerprint,
+      setup_configuration_fingerprint, execution_profile_fingerprint,
+      provider, environment_revision, completed_at DESC
+    )
+    WHERE outcome IN ('completed', 'noop', 'reused');
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_setup_evidence_execution_run
+    ON build_setup_evidence(execution_run_id);
+
+  CREATE TRIGGER IF NOT EXISTS preserve_build_setup_evidence_identity
+  BEFORE UPDATE OF id, project_id, execution_run_id, target_kind, target_key,
+    target_workspace_path, workspace_evidence_state, workspace_evidence_fingerprint,
+    setup_configuration_fingerprint, execution_profile_fingerprint, provider,
+    environment_revision, command_count, reused_from_evidence_id, started_at
+    ON build_setup_evidence
+  BEGIN
+    SELECT RAISE(ABORT, 'Build setup evidence identity is immutable');
+  END;
+`);
+db.exec('DROP TRIGGER IF EXISTS preserve_execution_environment_identity');
+db.exec('DROP TRIGGER IF EXISTS validate_execution_environment_binding_identity');
+db.exec('DROP TRIGGER IF EXISTS preserve_execution_environment_binding_identity');
+db.exec(`
+  CREATE TRIGGER preserve_execution_environment_identity
+  BEFORE UPDATE OF id, project_id, provider_kind, provider_version, target_kind, target_key,
+    target_workspace_path, environment_revision, workspace_mode,
+    environment_validation_fingerprint, execution_profile_revision_id, execution_profile_fingerprint,
+    credential_requirements_fingerprint, template_identity, template_digest,
+    agent_identity, compatible_agents_json, created_at ON execution_environments
+  WHEN NEW.id <> OLD.id OR NEW.project_id <> OLD.project_id OR NEW.provider_kind <> OLD.provider_kind
+    OR NEW.provider_version <> OLD.provider_version OR NEW.target_kind <> OLD.target_kind
+    OR NEW.target_key <> OLD.target_key OR NEW.target_workspace_path <> OLD.target_workspace_path
+    OR NEW.environment_revision <> OLD.environment_revision OR NEW.workspace_mode <> OLD.workspace_mode
+    OR NEW.environment_validation_fingerprint <> OLD.environment_validation_fingerprint
+    OR NEW.execution_profile_revision_id IS NOT OLD.execution_profile_revision_id
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.credential_requirements_fingerprint IS NOT OLD.credential_requirements_fingerprint
+    OR NEW.template_identity IS NOT OLD.template_identity OR NEW.template_digest IS NOT OLD.template_digest
+    OR NEW.agent_identity IS NOT OLD.agent_identity OR NEW.compatible_agents_json <> OLD.compatible_agents_json
+    OR NEW.created_at <> OLD.created_at
+  BEGIN SELECT RAISE(ABORT, 'Execution environment identity is immutable'); END;
+
+  CREATE TRIGGER validate_execution_environment_binding_identity
+  BEFORE INSERT ON execution_environment_run_bindings
+  WHEN NOT EXISTS (
+    SELECT 1 FROM execution_environments WHERE id = NEW.environment_id AND project_id = NEW.project_id
+      AND environment_revision = NEW.environment_revision
+      AND environment_validation_fingerprint = NEW.environment_validation_fingerprint
+      AND execution_profile_fingerprint IS NEW.execution_profile_fingerprint
+  )
+  BEGIN SELECT RAISE(ABORT, 'Execution environment binding identity does not match'); END;
+
+  CREATE TRIGGER preserve_execution_environment_binding_identity
+  BEFORE UPDATE OF environment_id, execution_run_id, project_id, relationship,
+    environment_revision, environment_validation_fingerprint, execution_profile_fingerprint, bound_at
+    ON execution_environment_run_bindings
+  WHEN NEW.environment_id <> OLD.environment_id OR NEW.execution_run_id <> OLD.execution_run_id
+    OR NEW.project_id <> OLD.project_id OR NEW.relationship <> OLD.relationship
+    OR NEW.environment_revision <> OLD.environment_revision
+    OR NEW.environment_validation_fingerprint <> OLD.environment_validation_fingerprint
+    OR NEW.execution_profile_fingerprint IS NOT OLD.execution_profile_fingerprint
+    OR NEW.bound_at <> OLD.bound_at
+  BEGIN SELECT RAISE(ABORT, 'Execution environment run binding identity is immutable'); END;
+`);
 db.exec('DROP TRIGGER IF EXISTS validate_execution_environment_binding_authority');
 db.exec(`
   CREATE TRIGGER IF NOT EXISTS validate_project_build_execution_provider_insert
@@ -2344,7 +3082,8 @@ db.exec(`
     SELECT RAISE(ABORT, 'Execution environment binding evidence is immutable');
   END;
 `);
-db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_reuse ON execution_environments(project_id, provider_kind, target_key, target_workspace_path, environment_revision, workspace_mode, environment_validation_fingerprint, lifecycle_state)');
+db.exec('DROP INDEX IF EXISTS idx_execution_environments_reuse');
+db.exec('CREATE INDEX idx_execution_environments_reuse ON execution_environments(project_id, provider_kind, target_key, target_workspace_path, environment_revision, workspace_mode, environment_validation_fingerprint, execution_profile_fingerprint, credential_requirements_fingerprint, retirement_requested_at, lifecycle_state)');
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_execution_environments_external_id ON execution_environments(provider_kind, external_id) WHERE external_id IS NOT NULL');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_cleanup ON execution_environments(lifecycle_state, cleanup_claim_id, updated_at, cleanup_attempts)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environment_events_sequence ON execution_environment_events(project_id, environment_id, sequence)');
@@ -2677,7 +3416,7 @@ db.exec(`
     CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
     CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
       'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
-      'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss')),
+      'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss')),
     CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
       AND total_persisted_bytes >= retained_end_offset),
     CHECK (output_retention_state IN ('retained', 'expired'))
@@ -2688,14 +3427,23 @@ ensureColumn('check_attempt_details', 'retained_output', "TEXT NOT NULL DEFAULT
 const checkAttemptSchema = db.prepare(`
   SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'check_attempt_details'
 `).get();
-if (checkAttemptSchema && !checkAttemptSchema.sql.includes('evidence_persistence_failure')) {
-    db.transaction(() => {
-        db.exec(`
-      DROP TRIGGER IF EXISTS preserve_check_attempt_snapshots;
-      DROP TRIGGER IF EXISTS preserve_completed_check_attempt_details;
-      ALTER TABLE check_attempt_details RENAME TO check_attempt_details_legacy;
-
-      CREATE TABLE check_attempt_details (
+if (checkAttemptSchema && (!checkAttemptSchema.sql.includes('evidence_persistence_failure')
+    || !checkAttemptSchema.sql.includes('ambiguous_process_loss'))) {
+    const foreignKeysEnabled = db.pragma('foreign_keys', { simple: true }) === 1;
+    if (foreignKeysEnabled) {
+        db.pragma('foreign_keys = OFF');
+    }
+    try {
+        const referencingTriggers = db.prepare(`
+      SELECT name FROM sqlite_master
+      WHERE type = 'trigger' AND sql LIKE '%check_attempt_details%'
+    `).all();
+        for (const trigger of referencingTriggers) {
+            db.exec(`DROP TRIGGER IF EXISTS "${trigger.name.replaceAll('"', '""')}"`);
+        }
+        db.transaction(() => {
+            db.exec(`
+      CREATE TABLE check_attempt_details_replacement (
         execution_run_id                TEXT PRIMARY KEY,
         batch_run_id                    TEXT NOT NULL,
         definition_id                  TEXT NOT NULL,
@@ -2721,13 +3469,13 @@ if (checkAttemptSchema && !checkAttemptSchema.sql.includes('evidence_persistence
         CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
         CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
           'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
-          'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss')),
+          'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss')),
         CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
           AND total_persisted_bytes >= retained_end_offset),
         CHECK (output_retention_state IN ('retained', 'expired'))
       );
 
-      INSERT INTO check_attempt_details (
+      INSERT INTO check_attempt_details_replacement (
         execution_run_id, batch_run_id, definition_id, command_snapshot_json, definition_fingerprint,
         initial_workspace_identity_json, final_workspace_identity_json, outcome, rerun_of_attempt_run_id,
         exit_code, exit_signal, exit_error, output_revision, retained_start_offset, retained_end_offset,
@@ -2738,11 +3486,22 @@ if (checkAttemptSchema && !checkAttemptSchema.sql.includes('evidence_persistence
         initial_workspace_identity_json, final_workspace_identity_json, outcome, rerun_of_attempt_run_id,
         exit_code, exit_signal, exit_error, output_revision, retained_start_offset, retained_end_offset,
         total_persisted_bytes, retained_output, output_retention_state
-      FROM check_attempt_details_legacy;
+      FROM check_attempt_details;
 
-      DROP TABLE check_attempt_details_legacy;
-    `);
-    })();
+      DROP TABLE check_attempt_details;
+      ALTER TABLE check_attempt_details_replacement RENAME TO check_attempt_details;
+      `);
+        })();
+    }
+    finally {
+        if (foreignKeysEnabled) {
+            db.pragma('foreign_keys = ON');
+        }
+    }
+    const foreignKeyViolation = db.pragma('foreign_key_check')[0];
+    if (foreignKeyViolation) {
+        throw new Error(`Check attempt migration left an invalid foreign key: ${JSON.stringify(foreignKeyViolation)}`);
+    }
 }
 db.exec(`
   CREATE TABLE IF NOT EXISTS check_attempt_diagnostic_parsers (
@@ -4327,6 +5086,11 @@ db.exec('CREATE INDEX IF NOT EXISTS idx_project_links_linked_project_id ON proje
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequences_project_status ON build_sequences(project_id, status)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequences_bundle_status ON build_sequences(worktree_bundle_id, status)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_build_sequence_tickets_sequence_position ON build_sequence_tickets(build_sequence_id, position)');
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_build_sequence_tickets_activation_run
+  ON build_sequence_tickets(activation_execution_run_id)
+  WHERE activation_execution_run_id IS NOT NULL
+`);
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_connections_provider_project ON integration_connections(provider, project_id)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_tickets_external_key ON tickets(external_provider, external_key)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_bundle_automation_state_project_bundle ON bundle_automation_state(project_id, worktree_bundle_id)');