@straiffi/archon 1.8.8 → 1.8.10

package/dist/server/db.js

@@ -61,6 +61,7 @@ db.exec(`
     required_check_definition_ids TEXT NOT NULL DEFAULT '[]',
     pre_review_check_definition_ids TEXT NOT NULL DEFAULT '[]',
     post_build_check_definition_ids TEXT NOT NULL DEFAULT '[]',
+    auto_fix_check_definition_ids TEXT NOT NULL DEFAULT '[]',
     test_commands TEXT,
     run_ide      TEXT,
     preview_service_name TEXT,
@@ -144,6 +145,7 @@ ensureColumn('projects', 'check_definitions', 'TEXT');
 ensureColumn('projects', 'required_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
 ensureColumn('projects', 'pre_review_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
 ensureColumn('projects', 'post_build_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
+ensureColumn('projects', 'auto_fix_check_definition_ids', "TEXT NOT NULL DEFAULT '[]'");
 ensureColumn('projects', 'test_commands', 'TEXT');
 ensureColumn('projects', 'helper_model', 'TEXT');
 ensureColumn('projects', 'helper_variant', 'TEXT');
@@ -1016,6 +1018,7 @@ db.exec(`
     previous_agent_log TEXT,
     previous_agent_message_id TEXT,
     streaming_response TEXT,
+    post_build_source_run_id TEXT,
     target_kind       TEXT NOT NULL DEFAULT 'repo_root',
     target_bundle_id  TEXT,
     target_branch_snapshot TEXT,
@@ -1038,6 +1041,12 @@ db.exec(`
 ensureColumn('chat_sessions', 'agent_message_id', 'TEXT');
 ensureColumn('chat_sessions', 'previous_agent_log', 'TEXT');
 ensureColumn('chat_sessions', 'previous_agent_message_id', 'TEXT');
+ensureColumn('chat_sessions', 'post_build_source_run_id', 'TEXT');
+db.exec(`
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_chat_sessions_post_build_source
+  ON chat_sessions(post_build_source_run_id)
+  WHERE post_build_source_run_id IS NOT NULL
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS chat_messages (
     id              TEXT PRIMARY KEY,
@@ -1213,6 +1222,7 @@ db.exec(`
     tickets_json    TEXT,
     dependencies_json TEXT,
     resource_urls_json TEXT,
+    repository_evidence_json TEXT,
     mermaid         TEXT,
     mockup          TEXT,
     created_at      DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -1223,6 +1233,65 @@ ensureColumn('spec_snapshots', 'plan_text', 'TEXT');
 ensureColumn('spec_snapshots', 'mockup', 'TEXT');
 ensureColumn('spec_snapshots', 'file_relation_graph', 'TEXT');
 ensureColumn('spec_snapshots', 'resource_urls_json', 'TEXT');
+ensureColumn('spec_snapshots', 'repository_evidence_json', 'TEXT');
+db.exec(`
+  DELETE FROM repository_graph_scan_references
+  WHERE reference_type = 'spec_snapshot'
+    AND NOT EXISTS (
+      SELECT 1
+      FROM spec_snapshots
+      INNER JOIN spec_sessions ON spec_sessions.id = spec_snapshots.spec_session_id
+      INNER JOIN repository_graph_scans
+        ON repository_graph_scans.id = repository_graph_scan_references.scan_id
+        AND repository_graph_scans.project_id = repository_graph_scan_references.project_id
+      WHERE spec_snapshots.id = repository_graph_scan_references.reference_id
+        AND spec_sessions.project_id = repository_graph_scan_references.project_id
+        AND repository_graph_scans.status = 'completed'
+    );
+
+  DROP TRIGGER IF EXISTS validate_spec_snapshot_graph_reference_insert;
+  DROP TRIGGER IF EXISTS reject_spec_snapshot_graph_reference_update;
+  DROP TRIGGER IF EXISTS delete_spec_snapshot_graph_reference;
+  DROP TRIGGER IF EXISTS reject_spec_snapshot_repository_evidence_update;
+
+  CREATE TRIGGER validate_spec_snapshot_graph_reference_insert
+  BEFORE INSERT ON repository_graph_scan_references
+  WHEN NEW.reference_type = 'spec_snapshot' AND NOT EXISTS (
+    SELECT 1
+    FROM spec_snapshots
+    INNER JOIN spec_sessions ON spec_sessions.id = spec_snapshots.spec_session_id
+    INNER JOIN repository_graph_scans
+      ON repository_graph_scans.id = NEW.scan_id
+      AND repository_graph_scans.project_id = NEW.project_id
+    WHERE spec_snapshots.id = NEW.reference_id
+      AND spec_sessions.project_id = NEW.project_id
+      AND repository_graph_scans.status = 'completed'
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Spec snapshot graph reference requires an owned snapshot and completed scan');
+  END;
+
+  CREATE TRIGGER reject_spec_snapshot_graph_reference_update
+  BEFORE UPDATE ON repository_graph_scan_references
+  WHEN OLD.reference_type = 'spec_snapshot' OR NEW.reference_type = 'spec_snapshot'
+  BEGIN
+    SELECT RAISE(ABORT, 'Spec snapshot graph references are immutable');
+  END;
+
+  CREATE TRIGGER delete_spec_snapshot_graph_reference
+  AFTER DELETE ON spec_snapshots
+  BEGIN
+    DELETE FROM repository_graph_scan_references
+    WHERE reference_type = 'spec_snapshot' AND reference_id = OLD.id;
+  END;
+
+  CREATE TRIGGER reject_spec_snapshot_repository_evidence_update
+  BEFORE UPDATE OF repository_evidence_json ON spec_snapshots
+  WHEN OLD.repository_evidence_json IS NOT NEW.repository_evidence_json
+  BEGIN
+    SELECT RAISE(ABORT, 'Spec snapshot repository evidence is immutable');
+  END;
+`);
 db.exec(`
   CREATE TABLE IF NOT EXISTS spec_message_attachments (
     attachment_id   TEXT PRIMARY KEY,
@@ -2463,12 +2532,27 @@ db.exec(`
   END;
 `);
 db.exec(`
+  CREATE TABLE IF NOT EXISTS agent_spawn_permits (
+    id               TEXT PRIMARY KEY,
+    execution_run_id TEXT NOT NULL UNIQUE,
+    status           TEXT NOT NULL DEFAULT 'active',
+    created_at       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    revoked_at       DATETIME,
+    FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
+    CHECK (status IN ('active', 'revoked')),
+    CHECK ((status = 'active' AND revoked_at IS NULL) OR (status = 'revoked' AND revoked_at IS NOT NULL))
+  );
+
   CREATE TABLE IF NOT EXISTS check_repair_details (
     execution_run_id                   TEXT PRIMARY KEY,
     source_batch_run_id                TEXT NOT NULL,
     target_kind                        TEXT NOT NULL,
     target_bundle_id                   TEXT,
-    ticket_id                          TEXT NOT NULL,
+    owner_type                        TEXT NOT NULL,
+    owner_id                          TEXT NOT NULL,
+    ticket_id                         TEXT,
+    causal_execution_run_id           TEXT NOT NULL,
+    causal_agent_run_id               TEXT NOT NULL,
     automation_progression_run_id      TEXT,
     automation_boundary_purpose        TEXT,
     initial_workspace_identity_json    TEXT NOT NULL,
@@ -2484,11 +2568,16 @@ db.exec(`
     updated_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
     FOREIGN KEY (source_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (causal_execution_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (causal_agent_run_id) REFERENCES agent_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (automation_progression_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (follow_up_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (rerun_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (retry_of_check_repair_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     CHECK (target_kind IN ('repo_root', 'bundle')),
+    CHECK (owner_type IN ('ticket', 'chat_session')),
+    CHECK ((owner_type = 'ticket' AND ticket_id = owner_id)
+      OR (owner_type = 'chat_session' AND ticket_id IS NULL)),
     CHECK ((target_kind = 'repo_root' AND target_bundle_id IS NULL)
       OR (target_kind = 'bundle' AND target_bundle_id IS NOT NULL AND length(trim(target_bundle_id)) > 0)),
     CHECK (length(configuration_fingerprint) = 64 AND configuration_fingerprint NOT GLOB '*[^0-9a-f]*'),
@@ -2505,6 +2594,236 @@ db.exec(`
     CHECK (terminal_result IS NULL OR terminal_result IN ('passed', 'failed', 'cancelled', 'interrupted')),
     CHECK (terminal_message IS NULL OR length(CAST(terminal_message AS BLOB)) <= 16384)
   );
+`);
+const checkRepairSchema = db.prepare(`
+  SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'check_repair_details'
+`).get();
+if (checkRepairSchema && !checkRepairSchema.sql.includes('owner_type')) {
+    db.transaction(() => {
+        db.exec(`
+      DROP TRIGGER IF EXISTS preserve_check_repair_provenance;
+      DROP TRIGGER IF EXISTS validate_check_repair_details_insert;
+      DROP TRIGGER IF EXISTS validate_check_repair_follow_up_update;
+      DROP TRIGGER IF EXISTS validate_check_repair_rerun_update;
+      DROP TRIGGER IF EXISTS preserve_check_repair_terminal_result;
+      DROP TRIGGER IF EXISTS preserve_check_repair_diagnostic_provenance;
+      DROP TRIGGER IF EXISTS preserve_check_repair_raw_output_provenance;
+      DROP TRIGGER IF EXISTS prevent_check_repair_raw_output_provenance_delete;
+      DROP TRIGGER IF EXISTS validate_check_repair_diagnostic_provenance_insert;
+      DROP TRIGGER IF EXISTS validate_check_repair_raw_output_provenance_insert;
+      CREATE TEMP TABLE check_repair_diagnostic_provenance_migration AS
+        SELECT * FROM check_repair_diagnostic_provenance;
+      CREATE TEMP TABLE check_repair_raw_output_provenance_migration AS
+        SELECT * FROM check_repair_raw_output_provenance;
+      DROP TABLE check_repair_diagnostic_provenance;
+      DROP TABLE check_repair_raw_output_provenance;
+      ALTER TABLE check_repair_details RENAME TO check_repair_details_legacy;
+
+      CREATE TABLE check_repair_details (
+        execution_run_id                   TEXT PRIMARY KEY,
+        source_batch_run_id                TEXT NOT NULL,
+        target_kind                        TEXT NOT NULL,
+        target_bundle_id                   TEXT,
+        owner_type                         TEXT NOT NULL,
+        owner_id                           TEXT NOT NULL,
+        ticket_id                          TEXT,
+        causal_execution_run_id            TEXT NOT NULL,
+        causal_agent_run_id                TEXT NOT NULL,
+        automation_progression_run_id      TEXT,
+        automation_boundary_purpose        TEXT,
+        initial_workspace_identity_json    TEXT NOT NULL,
+        configuration_fingerprint          TEXT NOT NULL,
+        effective_policy_fingerprint       TEXT,
+        definition_ids_json                TEXT NOT NULL,
+        follow_up_run_id                   TEXT,
+        rerun_batch_run_id                 TEXT,
+        terminal_result                    TEXT,
+        terminal_message                   TEXT,
+        retry_of_check_repair_run_id       TEXT,
+        created_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
+        FOREIGN KEY (source_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (causal_execution_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (causal_agent_run_id) REFERENCES agent_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (automation_progression_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (follow_up_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (rerun_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        FOREIGN KEY (retry_of_check_repair_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        CHECK (target_kind IN ('repo_root', 'bundle')),
+        CHECK (owner_type IN ('ticket', 'chat_session')),
+        CHECK ((owner_type = 'ticket' AND ticket_id = owner_id)
+          OR (owner_type = 'chat_session' AND ticket_id IS NULL)),
+        CHECK ((target_kind = 'repo_root' AND target_bundle_id IS NULL)
+          OR (target_kind = 'bundle' AND target_bundle_id IS NOT NULL AND length(trim(target_bundle_id)) > 0)),
+        CHECK (length(configuration_fingerprint) = 64 AND configuration_fingerprint NOT GLOB '*[^0-9a-f]*'),
+        CHECK (effective_policy_fingerprint IS NULL OR (
+          length(effective_policy_fingerprint) = 64 AND effective_policy_fingerprint NOT GLOB '*[^0-9a-f]*'
+        )),
+        CHECK (automation_boundary_purpose IS NULL OR automation_boundary_purpose IN (
+          'automation_review', 'automation_commit', 'automation_push', 'automation_pull_request'
+        )),
+        CHECK ((automation_progression_run_id IS NULL AND automation_boundary_purpose IS NULL)
+          OR (automation_progression_run_id IS NOT NULL AND automation_boundary_purpose IS NOT NULL)),
+        CHECK ((automation_progression_run_id IS NULL AND effective_policy_fingerprint IS NULL)
+          OR (automation_progression_run_id IS NOT NULL AND effective_policy_fingerprint IS NOT NULL)),
+        CHECK (terminal_result IS NULL OR terminal_result IN ('passed', 'failed', 'cancelled', 'interrupted')),
+        CHECK (terminal_message IS NULL OR length(CAST(terminal_message AS BLOB)) <= 16384)
+      );
+
+      CREATE TEMP TABLE check_repair_causal_migration AS
+      SELECT legacy.execution_run_id AS repair_run_id,
+        (
+          SELECT candidate.id
+          FROM execution_runs candidate
+          JOIN execution_run_links owner_link ON owner_link.execution_run_id = candidate.id
+            AND owner_link.project_id = candidate.project_id
+            AND owner_link.relationship = 'primary'
+            AND owner_link.entity_type = 'ticket'
+            AND owner_link.entity_id = legacy.ticket_id
+          WHERE candidate.project_id = source.project_id
+            AND candidate.kind IN ('build', 'build_follow_up')
+            AND candidate.id IS NOT legacy.follow_up_run_id
+            AND candidate.parent_run_id IS NOT legacy.execution_run_id
+            AND candidate.created_at <= source.created_at
+            AND EXISTS (SELECT 1 FROM agent_runs agent WHERE agent.execution_run_id = candidate.id)
+          ORDER BY candidate.created_at DESC, candidate.id DESC
+          LIMIT 1
+        ) AS causal_execution_run_id
+      FROM check_repair_details_legacy legacy
+      JOIN execution_runs source ON source.id = legacy.source_batch_run_id;
+
+      INSERT INTO check_repair_details (
+        execution_run_id, source_batch_run_id, target_kind, target_bundle_id,
+        owner_type, owner_id, ticket_id, causal_execution_run_id, causal_agent_run_id,
+        automation_progression_run_id, automation_boundary_purpose, initial_workspace_identity_json,
+        configuration_fingerprint, effective_policy_fingerprint, definition_ids_json,
+        follow_up_run_id, rerun_batch_run_id, terminal_result, terminal_message,
+        retry_of_check_repair_run_id, created_at, updated_at
+      )
+      SELECT legacy.execution_run_id, legacy.source_batch_run_id, legacy.target_kind, legacy.target_bundle_id,
+        'ticket', legacy.ticket_id, legacy.ticket_id,
+        causal_run.id, causal_agent.id,
+        legacy.automation_progression_run_id, legacy.automation_boundary_purpose,
+        legacy.initial_workspace_identity_json, legacy.configuration_fingerprint,
+        legacy.effective_policy_fingerprint, legacy.definition_ids_json, legacy.follow_up_run_id,
+        legacy.rerun_batch_run_id, legacy.terminal_result, legacy.terminal_message,
+        legacy.retry_of_check_repair_run_id, legacy.created_at, legacy.updated_at
+      FROM check_repair_details_legacy legacy
+      JOIN execution_runs source ON source.id = legacy.source_batch_run_id
+      JOIN check_repair_causal_migration causal ON causal.repair_run_id = legacy.execution_run_id
+      JOIN execution_runs causal_run ON causal_run.id = causal.causal_execution_run_id
+        AND causal_run.project_id = source.project_id
+        AND causal_run.kind IN ('build', 'build_follow_up')
+      JOIN agent_runs causal_agent ON causal_agent.id = (
+        SELECT candidate_agent.id FROM agent_runs candidate_agent
+        WHERE candidate_agent.execution_run_id = causal_run.id
+        ORDER BY CASE WHEN candidate_agent.role = 'main' THEN 0 ELSE 1 END,
+          candidate_agent.run_index ASC, candidate_agent.created_at ASC, candidate_agent.id ASC
+        LIMIT 1
+      )
+      JOIN tickets owner ON owner.id = legacy.ticket_id AND owner.project_id = source.project_id
+      ;
+
+      CREATE TEMP TABLE check_repair_unrecoverable_migration AS
+      SELECT legacy.execution_run_id AS repair_run_id, repair.project_id, legacy.ticket_id,
+        legacy.follow_up_run_id
+      FROM check_repair_details_legacy legacy
+      JOIN execution_runs repair ON repair.id = legacy.execution_run_id AND repair.kind = 'check_repair'
+      LEFT JOIN check_repair_details migrated ON migrated.execution_run_id = legacy.execution_run_id
+      WHERE migrated.execution_run_id IS NULL;
+
+      CREATE TEMP TABLE check_repair_unrecoverable_children_migration AS
+      SELECT child.id AS child_run_id, unrecoverable.project_id, unrecoverable.ticket_id
+      FROM check_repair_unrecoverable_migration unrecoverable
+      JOIN execution_runs child ON child.id = unrecoverable.follow_up_run_id
+        AND child.project_id = unrecoverable.project_id
+        AND child.parent_run_id = unrecoverable.repair_run_id
+        AND child.kind = 'build_follow_up'
+        AND child.status IN ('queued', 'running', 'waiting')
+      JOIN execution_run_links owner_link ON owner_link.execution_run_id = child.id
+        AND owner_link.project_id = child.project_id
+        AND owner_link.entity_type = 'ticket'
+        AND owner_link.entity_id = unrecoverable.ticket_id
+        AND owner_link.relationship = 'primary';
+
+      UPDATE agent_runs
+      SET agent_status = 'error', response_text = COALESCE(response_text, streaming_response),
+        streaming_response = NULL,
+        failure_message = 'Legacy check repair causal provenance could not be recovered',
+        completed_at = COALESCE(completed_at, CURRENT_TIMESTAMP), updated_at = CURRENT_TIMESTAMP
+      WHERE execution_run_id IN (
+        SELECT child_run_id FROM check_repair_unrecoverable_children_migration
+      ) AND agent_status = 'running' AND completed_at IS NULL;
+
+      UPDATE execution_runs
+      SET status = 'interrupted', domain_status = 'interrupted',
+        failure_code = 'legacy_repair_provenance_unavailable',
+        failure_message = 'Legacy check repair causal provenance could not be recovered',
+        completed_at = COALESCE(completed_at, CURRENT_TIMESTAMP), updated_at = CURRENT_TIMESTAMP
+      WHERE id IN (
+        SELECT child_run_id FROM check_repair_unrecoverable_children_migration
+      ) AND status IN ('queued', 'running', 'waiting');
+
+      UPDATE tickets
+      SET agent_status = 'error',
+        agent_log = 'Legacy check repair causal provenance could not be recovered',
+        streaming_response = NULL, updated_at = CURRENT_TIMESTAMP
+      WHERE agent_status = 'running' AND EXISTS (
+        SELECT 1 FROM check_repair_unrecoverable_children_migration child
+        WHERE child.project_id = tickets.project_id AND child.ticket_id = tickets.id
+      );
+
+      UPDATE execution_runs
+      SET status = 'interrupted', domain_status = 'interrupted',
+        failure_code = 'legacy_repair_provenance_unavailable',
+        failure_message = 'Legacy check repair causal provenance could not be recovered',
+        completed_at = COALESCE(completed_at, CURRENT_TIMESTAMP), updated_at = CURRENT_TIMESTAMP
+      WHERE kind = 'check_repair' AND status IN ('queued', 'running', 'waiting')
+        AND id IN (
+          SELECT repair_run_id FROM check_repair_unrecoverable_migration
+        );
+
+      DROP TABLE check_repair_details_legacy;
+
+      CREATE TABLE check_repair_diagnostic_provenance (
+        check_repair_run_id TEXT NOT NULL,
+        ordinal             INTEGER NOT NULL,
+        diagnostic_id       TEXT NOT NULL,
+        attempt_run_id      TEXT NOT NULL,
+        definition_id       TEXT NOT NULL,
+        PRIMARY KEY (check_repair_run_id, ordinal),
+        UNIQUE (check_repair_run_id, diagnostic_id),
+        FOREIGN KEY (check_repair_run_id) REFERENCES check_repair_details(execution_run_id) ON DELETE CASCADE,
+        FOREIGN KEY (attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        CHECK (ordinal >= 0)
+      );
+      CREATE TABLE check_repair_raw_output_provenance (
+        check_repair_run_id TEXT NOT NULL,
+        ordinal             INTEGER NOT NULL,
+        attempt_run_id      TEXT NOT NULL,
+        definition_id       TEXT NOT NULL,
+        PRIMARY KEY (check_repair_run_id, ordinal),
+        UNIQUE (check_repair_run_id, attempt_run_id),
+        FOREIGN KEY (check_repair_run_id) REFERENCES check_repair_details(execution_run_id) ON DELETE CASCADE,
+        FOREIGN KEY (attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+        CHECK (ordinal >= 0)
+      );
+      INSERT INTO check_repair_diagnostic_provenance
+        SELECT migration.* FROM check_repair_diagnostic_provenance_migration migration
+        JOIN check_repair_details repair ON repair.execution_run_id = migration.check_repair_run_id;
+      INSERT INTO check_repair_raw_output_provenance
+        SELECT migration.* FROM check_repair_raw_output_provenance_migration migration
+        JOIN check_repair_details repair ON repair.execution_run_id = migration.check_repair_run_id;
+      DROP TABLE check_repair_diagnostic_provenance_migration;
+      DROP TABLE check_repair_raw_output_provenance_migration;
+      DROP TABLE check_repair_causal_migration;
+      DROP TABLE check_repair_unrecoverable_children_migration;
+      DROP TABLE check_repair_unrecoverable_migration;
+    `);
+    })();
+}
+db.exec(`
 
   CREATE TABLE IF NOT EXISTS check_repair_diagnostic_provenance (
     check_repair_run_id TEXT NOT NULL,
@@ -2532,7 +2851,8 @@ db.exec(`
   );
 
   CREATE TRIGGER IF NOT EXISTS preserve_check_repair_provenance
-  BEFORE UPDATE OF execution_run_id, source_batch_run_id, target_kind, target_bundle_id, ticket_id,
+  BEFORE UPDATE OF execution_run_id, source_batch_run_id, target_kind, target_bundle_id,
+    owner_type, owner_id, ticket_id, causal_execution_run_id, causal_agent_run_id,
     automation_progression_run_id, automation_boundary_purpose, initial_workspace_identity_json,
     configuration_fingerprint, effective_policy_fingerprint, definition_ids_json,
     retry_of_check_repair_run_id, created_at
@@ -2574,19 +2894,30 @@ db.exec(`
     FROM execution_runs repair
     JOIN execution_runs source ON source.id = NEW.source_batch_run_id AND source.project_id = repair.project_id
     JOIN check_batch_details source_details ON source_details.execution_run_id = source.id
-    JOIN tickets ticket ON ticket.id = NEW.ticket_id AND ticket.project_id = repair.project_id
+    JOIN execution_runs causal ON causal.id = NEW.causal_execution_run_id AND causal.project_id = repair.project_id
+    JOIN agent_runs causal_agent ON causal_agent.id = NEW.causal_agent_run_id
+      AND causal_agent.execution_run_id = causal.id
     WHERE repair.id = NEW.execution_run_id AND repair.kind = 'check_repair'
-      AND NEW.target_kind = 'bundle' AND NEW.target_bundle_id IS NOT NULL
+      AND ((NEW.target_kind = 'bundle' AND NEW.target_bundle_id IS NOT NULL)
+        OR (NEW.target_kind = 'repo_root' AND NEW.target_bundle_id IS NULL))
       AND source.kind = 'check_batch' AND source.status = 'failed'
       AND source_details.target_kind = NEW.target_kind
       AND source_details.target_bundle_id IS NEW.target_bundle_id
       AND source_details.automation_boundary_purpose IS NEW.automation_boundary_purpose
+      AND causal.kind IN ('build', 'build_follow_up', 'chat_turn')
+      AND ((NEW.owner_type = 'ticket' AND NEW.ticket_id = NEW.owner_id AND causal.kind IN ('build', 'build_follow_up')
+          AND EXISTS (SELECT 1 FROM tickets owner WHERE owner.id = NEW.owner_id AND owner.project_id = repair.project_id
+            AND owner.worktree_bundle_id = NEW.target_bundle_id))
+        OR (NEW.owner_type = 'chat_session' AND NEW.ticket_id IS NULL AND causal.kind = 'chat_turn'
+          AND EXISTS (SELECT 1 FROM chat_sessions owner WHERE owner.id = NEW.owner_id AND owner.project_id = repair.project_id
+            AND owner.mode = 'build' AND owner.target_kind = NEW.target_kind
+            AND owner.target_bundle_id IS NEW.target_bundle_id)))
       AND (NEW.follow_up_run_id IS NULL OR EXISTS (
         SELECT 1 FROM execution_runs follow_up
         WHERE follow_up.id = NEW.follow_up_run_id AND follow_up.project_id = repair.project_id
-          AND follow_up.kind = 'build_follow_up' AND follow_up.parent_run_id = repair.id
+          AND follow_up.kind = CASE NEW.owner_type WHEN 'ticket' THEN 'build_follow_up' ELSE 'chat_turn' END
+          AND follow_up.parent_run_id = repair.id
       ))
-      AND ticket.worktree_bundle_id = NEW.target_bundle_id
       AND (NEW.retry_of_check_repair_run_id IS NULL OR EXISTS (
         SELECT 1 FROM execution_runs retry_source
         WHERE retry_source.id = NEW.retry_of_check_repair_run_id
@@ -2668,7 +2999,8 @@ db.exec(`
       JOIN execution_runs follow_up ON follow_up.id = NEW.follow_up_run_id
         AND follow_up.project_id = repair.project_id
       WHERE repair.id = OLD.execution_run_id AND repair.kind = 'check_repair'
-        AND follow_up.kind = 'build_follow_up' AND follow_up.parent_run_id = repair.id
+        AND follow_up.kind = CASE OLD.owner_type WHEN 'ticket' THEN 'build_follow_up' ELSE 'chat_turn' END
+        AND follow_up.parent_run_id = repair.id
     )
   )
   BEGIN
@@ -2709,6 +3041,97 @@ db.exec(`
   END;
 `);
 db.exec(`
+
+  CREATE TABLE IF NOT EXISTS check_auto_fix_loops (
+    execution_run_id                   TEXT PRIMARY KEY,
+    project_id                         TEXT NOT NULL,
+    originating_batch_run_id           TEXT NOT NULL UNIQUE,
+    target_kind                        TEXT NOT NULL,
+    target_bundle_id                   TEXT,
+    owner_type                         TEXT NOT NULL,
+    owner_id                           TEXT NOT NULL,
+    causal_execution_run_id            TEXT NOT NULL,
+    causal_agent_run_id                TEXT NOT NULL,
+    automation_progression_run_id      TEXT,
+    automation_boundary_purpose        TEXT,
+    selected_definitions_json          TEXT NOT NULL,
+    auto_fix_definition_ids_json       TEXT NOT NULL,
+    definition_fingerprint             TEXT NOT NULL,
+    owner_config_json                  TEXT NOT NULL,
+    initial_workspace_identity_json    TEXT NOT NULL,
+    cancellation_requested             INTEGER NOT NULL DEFAULT 0,
+    attempt_count                      INTEGER NOT NULL DEFAULT 0,
+    final_batch_run_id                 TEXT,
+    terminal_reason                    TEXT,
+    terminal_message                   TEXT,
+    created_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (originating_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (causal_execution_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (causal_agent_run_id) REFERENCES agent_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (automation_progression_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (final_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    CHECK (target_kind IN ('repo_root', 'bundle')),
+    CHECK ((target_kind = 'repo_root' AND target_bundle_id IS NULL)
+      OR (target_kind = 'bundle' AND target_bundle_id IS NOT NULL)),
+    CHECK (owner_type IN ('ticket', 'chat_session')),
+    CHECK (length(definition_fingerprint) = 64),
+    CHECK (cancellation_requested IN (0, 1)),
+    CHECK (attempt_count BETWEEN 0 AND 3),
+    CHECK (terminal_reason IS NULL OR terminal_reason IN (
+      'passed', 'ineligible', 'non_auto_fixable_only', 'agent_failure',
+      'no_workspace_changes', 'unchanged_failures', 'user_cancelled',
+      'stale', 'exhausted', 'interrupted'
+    ))
+  );
+
+  CREATE TABLE IF NOT EXISTS check_auto_fix_attempts (
+    loop_run_id                        TEXT NOT NULL,
+    ordinal                            INTEGER NOT NULL,
+    source_batch_run_id                TEXT NOT NULL,
+    enabled_failure_signature          TEXT NOT NULL,
+    workspace_before_json              TEXT NOT NULL,
+    child_run_id                       TEXT,
+    launch_outcome                     TEXT,
+    rerun_batch_run_id                 TEXT,
+    workspace_after_json               TEXT,
+    terminal_reason                    TEXT,
+    terminal_message                   TEXT,
+    created_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at                         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (loop_run_id, ordinal),
+    FOREIGN KEY (loop_run_id) REFERENCES check_auto_fix_loops(execution_run_id) ON DELETE CASCADE,
+    FOREIGN KEY (source_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (child_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    FOREIGN KEY (rerun_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
+    CHECK (ordinal BETWEEN 1 AND 3),
+    CHECK (length(enabled_failure_signature) = 64),
+    CHECK (launch_outcome IS NULL OR launch_outcome IN ('continued', 'fresh', 'rejected', 'completed', 'failed', 'cancelled'))
+  );
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_auto_fix_loop_snapshot
+  BEFORE UPDATE OF execution_run_id, originating_batch_run_id, target_kind, target_bundle_id,
+    owner_type, owner_id, causal_execution_run_id, causal_agent_run_id,
+    automation_progression_run_id, automation_boundary_purpose, selected_definitions_json,
+    auto_fix_definition_ids_json, definition_fingerprint, owner_config_json,
+    initial_workspace_identity_json, created_at ON check_auto_fix_loops
+  BEGIN
+    SELECT RAISE(ABORT, 'Check auto-fix loop snapshot is immutable');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS preserve_check_auto_fix_attempt_snapshot
+  BEFORE UPDATE OF loop_run_id, ordinal, source_batch_run_id, enabled_failure_signature,
+    workspace_before_json, created_at ON check_auto_fix_attempts
+  BEGIN
+    SELECT RAISE(ABORT, 'Check auto-fix attempt snapshot is immutable');
+  END;
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_check_auto_fix_active_target
+  ON check_auto_fix_loops(target_kind, COALESCE(target_bundle_id, ''))
+  WHERE terminal_reason IS NULL;
+
   CREATE TABLE IF NOT EXISTS check_gate_evaluations (
     id                              TEXT PRIMARY KEY,
     project_id                      TEXT NOT NULL,
@@ -2831,6 +3254,23 @@ db.exec(`
     SELECT RAISE(ABORT, 'Invalid check gate evaluation attempt lineage');
   END;
 `);
+ensureColumn('check_auto_fix_loops', 'project_id', 'TEXT');
+db.exec(`
+  UPDATE check_auto_fix_loops
+  SET project_id = (
+    SELECT project_id FROM execution_runs WHERE execution_runs.id = check_auto_fix_loops.execution_run_id
+  )
+  WHERE project_id IS NULL;
+  DROP INDEX IF EXISTS idx_check_auto_fix_active_target;
+  CREATE UNIQUE INDEX idx_check_auto_fix_active_target
+  ON check_auto_fix_loops(project_id, target_kind, COALESCE(target_bundle_id, ''))
+  WHERE terminal_reason IS NULL;
+  CREATE TRIGGER IF NOT EXISTS preserve_check_auto_fix_loop_project
+  BEFORE UPDATE OF project_id ON check_auto_fix_loops
+  BEGIN
+    SELECT RAISE(ABORT, 'Check auto-fix loop project is immutable');
+  END;
+`);
 ensureColumn('check_gate_evaluations', 'expected_attempt_count', 'INTEGER NOT NULL DEFAULT 0');
 ensureColumn('check_gate_evaluations', 'attempts_sealed', 'INTEGER NOT NULL DEFAULT 1');
 db.exec(`
@@ -2871,16 +3311,6 @@ db.exec(`
       WHERE id = NEW.automation_progression_run_id
         AND project_id = NEW.project_id AND kind = 'automation_progression'
     )
-  ) OR (
-    NEW.source_batch_run_id IS NOT NULL
-    AND NOT EXISTS (
-      SELECT 1 FROM execution_runs batch
-      WHERE batch.id = NEW.source_batch_run_id
-        AND (
-          (batch.initiated_by <> 'automation' AND batch.parent_run_id IS NULL)
-          OR (batch.initiated_by = 'automation' AND batch.parent_run_id = NEW.automation_progression_run_id)
-        )
-    )
   )
   BEGIN
     SELECT RAISE(ABORT, 'Invalid check gate evaluation lineage');
@@ -3016,32 +3446,46 @@ db.exec(`
                 OR (NEW.target_kind = 'repo_root' AND NEW.target_bundle_id IS NULL
                   AND bundle.kind = 'project_root')
               )
-               AND NOT EXISTS (
-                 SELECT 1 FROM execution_runs sibling
+              AND NOT EXISTS (
+                SELECT 1 FROM execution_runs sibling
                 WHERE sibling.project_id = run.project_id
                   AND sibling.parent_run_id = progression.id
                   AND sibling.id <> run.id
-                   AND sibling.kind IN ('check_batch', 'check_repair', 'review', 'automation_review_fix', 'automation_commit', 'automation_push', 'automation_pull_request')
-                   AND sibling.status IN ('queued', 'running', 'waiting')
-                   AND NOT (
-                     sibling.kind = 'check_repair'
-                     AND NEW.rerun_of_batch_run_id IS NOT NULL
-                     AND EXISTS (
-                       SELECT 1 FROM check_repair_details repair_details
-                       WHERE repair_details.execution_run_id = sibling.id
-                         AND repair_details.source_batch_run_id = NEW.rerun_of_batch_run_id
-                         AND repair_details.terminal_result IS NULL
-                         AND repair_details.automation_progression_run_id = progression.id
-                         AND repair_details.automation_boundary_purpose = NEW.automation_boundary_purpose
-                         AND repair_details.target_kind = NEW.target_kind
-                         AND repair_details.target_bundle_id IS NEW.target_bundle_id
-                     )
-                   )
-               )
+                  AND sibling.kind IN ('check_batch', 'check_repair', 'review', 'automation_review_fix', 'automation_commit', 'automation_push', 'automation_pull_request')
+                  AND sibling.status IN ('queued', 'running', 'waiting')
+                  AND NOT (
+                    sibling.kind = 'check_repair'
+                    AND NEW.rerun_of_batch_run_id IS NOT NULL
+                    AND EXISTS (
+                      SELECT 1 FROM check_repair_details repair_details
+                      WHERE repair_details.execution_run_id = sibling.id
+                        AND repair_details.source_batch_run_id = NEW.rerun_of_batch_run_id
+                        AND repair_details.terminal_result IS NULL
+                        AND repair_details.automation_progression_run_id = progression.id
+                        AND repair_details.automation_boundary_purpose = NEW.automation_boundary_purpose
+                        AND repair_details.target_kind = NEW.target_kind
+                        AND repair_details.target_bundle_id IS NEW.target_bundle_id
+                    )
+                  )
+              )
           )
+        )
+        OR (
+          run.initiated_by = 'automation'
+          AND NEW.purpose = 'auto_fix'
+          AND NEW.rerun_of_batch_run_id IS NOT NULL
+          AND EXISTS (
+            SELECT 1 FROM check_auto_fix_loops loop
+            WHERE loop.execution_run_id = run.parent_run_id
+              AND loop.originating_batch_run_id = NEW.causal_source_run_id
+              AND loop.final_batch_run_id = NEW.rerun_of_batch_run_id
+              AND loop.target_kind = NEW.target_kind
+              AND loop.target_bundle_id IS NEW.target_bundle_id
+              AND loop.terminal_reason IS NULL
+          )
+        )
       )
       AND (run.initiated_by = 'automation' OR NEW.automation_boundary_purpose IS NULL)
-    )
   ) OR (
     NEW.rerun_of_batch_run_id IS NOT NULL AND NOT EXISTS (
       SELECT 1 FROM execution_runs source, execution_runs current