@team-semicolon/semicolony-cli 4.18.51 → 4.18.52

package/migrations/154_hive_cron_evidence_provider_grants.sql

@@ -0,0 +1,816 @@
+-- @schema-retarget: off
+-- Hive cron v2 evidence writer: explicit least-privilege sc_provider ACLs.
+-- Migration 135 must have created the non-bypass provider role and RLS helpers.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_get_template(p_job_id text)
+RETURNS TABLE (
+  bot_id text,
+  job_id text,
+  runtime_source text,
+  permission text,
+  resource_scopes text[],
+  destination text,
+  timeout_seconds integer,
+  idempotency_key_template text,
+  expected_outcome_digest text,
+  source_hash text,
+  action_kind text,
+  action_version integer,
+  action_contract_digest text,
+  updated_at timestamptz
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+  SELECT template.bot_id,
+         template.job_id,
+         template.runtime_source,
+         template.permission,
+         template.resource_scopes,
+         template.destination,
+         template.timeout_seconds,
+         template.idempotency_key_template,
+         template.expected_outcome_digest,
+         template.source_hash,
+         template.action_kind,
+         template.action_version,
+         template.action_contract_digest,
+         template.updated_at
+  FROM semicolony.cron_capability_templates AS template
+  WHERE template.bot_id = 'semi'
+    AND template.job_id = p_job_id
+    AND template.runtime_source = 'hive-cron-v2';
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_lock_authority(
+  p_job_id text,
+  p_idempotency_key text,
+  p_claim_id text
+)
+RETURNS TABLE (authority_status text)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  job_runtime_source text;
+  lease_state text;
+BEGIN
+  IF p_job_id IS NULL
+     OR p_job_id !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+     OR p_idempotency_key IS NULL
+     OR p_idempotency_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$'
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length('cron:' || p_job_id || ':') + 24
+     OR pg_catalog.left(
+          p_idempotency_key,
+          pg_catalog.char_length('cron:' || p_job_id || ':')
+        ) IS DISTINCT FROM 'cron:' || p_job_id || ':'
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR p_claim_id IS NULL
+     OR p_claim_id !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text;
+    RETURN;
+  END IF;
+
+  SELECT job.runtime_source
+    INTO job_runtime_source
+    FROM semicolony.bot_cron_jobs AS job
+   WHERE job.bot_id = 'semi'
+     AND job.job_id = p_job_id
+   FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'evidence_job_not_found'::text;
+    RETURN;
+  END IF;
+  IF job_runtime_source IS DISTINCT FROM 'hive-cron-v2' THEN
+    RETURN QUERY SELECT 'evidence_job_runtime_mismatch'::text;
+    RETURN;
+  END IF;
+
+  PERFORM template.job_id
+    FROM semicolony.cron_capability_templates AS template
+   WHERE template.bot_id = 'semi'
+     AND template.job_id = p_job_id
+     AND template.runtime_source = 'hive-cron-v2'
+     AND template.action_kind IS NOT NULL
+     AND template.action_version IS NOT NULL
+     AND template.action_contract_digest IS NOT NULL
+   FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'current_template_not_found'::text;
+    RETURN;
+  END IF;
+
+  SELECT lease.state
+    INTO lease_state
+    FROM semicolony.cron_read_action_occurrence_leases AS lease
+   WHERE lease.idempotency_key = p_idempotency_key
+     AND lease.claim_id = p_claim_id
+   FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'occurrence_lease_not_owned'::text;
+    RETURN;
+  END IF;
+  IF lease_state IS NULL OR lease_state NOT IN ('acquired', 'completed') THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text;
+    RETURN;
+  END IF;
+
+  PERFORM outbox.idempotency_key
+    FROM semicolony.cron_read_action_relay_outbox AS outbox
+   WHERE outbox.idempotency_key = p_idempotency_key
+   FOR UPDATE;
+
+  RETURN QUERY SELECT 'locked'::text;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_reconcile(
+  p_job_id text,
+  p_idempotency_key text
+)
+RETURNS TABLE (
+  lease_count integer,
+  lease_claim_id text,
+  lease_state text,
+  lease_completed_at timestamptz,
+  outbox_count integer,
+  outbox_request_digest text,
+  outbox_state text,
+  outbox_outcome_status text,
+  outbox_error_code text,
+  outbox_completed_at timestamptz,
+  evidence_count integer,
+  evidence_commitment_id text,
+  evidence_claim_id text,
+  evidence_stage text,
+  evidence_run_status text,
+  evidence_relay_required jsonb,
+  evidence_relay_outcome text,
+  evidence_relay_request_digest text,
+  evidence_output_digest text,
+  evidence_completed_at timestamptz,
+  event_count integer,
+  event_commitment_id text,
+  event_type text,
+  event_run_status text,
+  event_output_digest text,
+  event_occurred_at timestamptz
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+  WITH authority AS (
+    SELECT job.job_id
+    FROM semicolony.bot_cron_jobs AS job
+    WHERE job.bot_id = 'semi'
+      AND job.job_id = p_job_id
+      AND job.runtime_source = 'hive-cron-v2'
+      AND p_idempotency_key IS NOT NULL
+      AND pg_catalog.char_length(p_idempotency_key)
+            = pg_catalog.char_length('cron:' || p_job_id || ':') + 24
+      AND pg_catalog.left(
+            p_idempotency_key,
+            pg_catalog.char_length('cron:' || p_job_id || ':')
+          ) = 'cron:' || p_job_id || ':'
+      AND pg_catalog.right(p_idempotency_key, 24)
+            ~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+  ),
+  lease_rows AS (
+    SELECT lease.claim_id, lease.state, lease.completed_at
+    FROM semicolony.cron_read_action_occurrence_leases AS lease
+    WHERE lease.idempotency_key = p_idempotency_key
+      AND EXISTS (SELECT 1 FROM authority)
+    LIMIT 2
+  ),
+  outbox_rows AS (
+    SELECT outbox.request_digest, outbox.state, outbox.outcome_status,
+           outbox.error_code, outbox.completed_at
+    FROM semicolony.cron_read_action_relay_outbox AS outbox
+    WHERE outbox.idempotency_key = p_idempotency_key
+      AND EXISTS (SELECT 1 FROM authority)
+    LIMIT 2
+  ),
+  evidence_rows AS (
+    SELECT evidence.id AS commitment_id,
+           evidence.metadata->>'claim_id' AS claim_id,
+           evidence.metadata->>'cron_parity_stage' AS stage,
+           evidence.metadata->>'run_status' AS run_status,
+           evidence.metadata->'relay_required' AS relay_required,
+           evidence.metadata->>'relay_outcome' AS relay_outcome,
+           evidence.metadata->>'relay_request_digest' AS relay_request_digest,
+           evidence.metadata->>'output_digest' AS output_digest,
+           evidence.completed_at
+    FROM semicolony.bot_commitments AS evidence
+    WHERE evidence.bot_id = 'semi'
+      AND evidence.source_type = 'cron'
+      AND evidence.runtime_source = 'hive-cron-v2'
+      AND evidence.metadata->>'cron_parity_runtime' = 'hive-cron-v2'
+      AND evidence.metadata->>'idempotency_key' = p_idempotency_key
+      AND EXISTS (SELECT 1 FROM authority)
+    LIMIT 2
+  ),
+  event_rows AS (
+    SELECT event.commitment_id,
+           event.event_type,
+           event.payload->>'run_status' AS run_status,
+           event.payload->>'output_digest' AS output_digest,
+           event.occurred_at
+    FROM semicolony.commitment_events AS event
+    WHERE event.bot_id = 'semi'
+      AND event.source_type = 'cron'
+      AND event.runtime_source = 'hive-cron-v2'
+      AND event.event_type = 'cron_run_recorded'
+      AND event.payload->>'job_id' = p_job_id
+      AND event.payload->>'occurrence_idempotency_key' = p_idempotency_key
+      AND event.idempotency_key = 'cron:' || event.commitment_id
+      AND EXISTS (SELECT 1 FROM authority)
+    LIMIT 2
+  )
+  SELECT
+    (SELECT COUNT(*)::integer FROM lease_rows),
+    (SELECT claim_id FROM lease_rows LIMIT 1),
+    (SELECT state FROM lease_rows LIMIT 1),
+    (SELECT completed_at FROM lease_rows LIMIT 1),
+    (SELECT COUNT(*)::integer FROM outbox_rows),
+    (SELECT request_digest FROM outbox_rows LIMIT 1),
+    (SELECT state FROM outbox_rows LIMIT 1),
+    (SELECT outcome_status FROM outbox_rows LIMIT 1),
+    (SELECT error_code FROM outbox_rows LIMIT 1),
+    (SELECT completed_at FROM outbox_rows LIMIT 1),
+    (SELECT COUNT(*)::integer FROM evidence_rows),
+    (SELECT commitment_id FROM evidence_rows LIMIT 1),
+    (SELECT claim_id FROM evidence_rows LIMIT 1),
+    (SELECT stage FROM evidence_rows LIMIT 1),
+    (SELECT run_status FROM evidence_rows LIMIT 1),
+    (SELECT relay_required FROM evidence_rows LIMIT 1),
+    (SELECT relay_outcome FROM evidence_rows LIMIT 1),
+    (SELECT relay_request_digest FROM evidence_rows LIMIT 1),
+    (SELECT output_digest FROM evidence_rows LIMIT 1),
+    (SELECT completed_at FROM evidence_rows LIMIT 1),
+    (SELECT COUNT(*)::integer FROM event_rows),
+    (SELECT commitment_id FROM event_rows LIMIT 1),
+    (SELECT event_type FROM event_rows LIMIT 1),
+    (SELECT run_status FROM event_rows LIMIT 1),
+    (SELECT output_digest FROM event_rows LIMIT 1),
+    (SELECT occurred_at FROM event_rows LIMIT 1)
+  WHERE EXISTS (SELECT 1 FROM authority);
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_write_evidence(
+  p_job_id text,
+  p_idempotency_key text,
+  p_claim_id text,
+  p_evidence jsonb
+)
+RETURNS TABLE (
+  write_status text,
+  commitment_id text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  envelope_shape_ok boolean;
+  metadata_shape_ok boolean;
+  metadata_value jsonb;
+  stage_value text;
+  status_value text;
+  started_at_text text;
+  started_at_value timestamptz;
+  completed_at_value timestamptz;
+  duration_ms_value integer;
+  output_digest_value text;
+  p_commitment_id text;
+  job_row record;
+  template_row record;
+  lease_row record;
+  outbox_row record;
+  commitment_row record;
+  event_row record;
+  outbox_exists boolean;
+  commitment_exists boolean;
+  event_exists boolean;
+  expected_pipeline_context jsonb;
+  expected_commitment_metadata jsonb;
+  expected_event_payload jsonb;
+  expected_title text;
+  expected_description text;
+  affected_count integer;
+BEGIN
+  IF p_job_id IS NULL
+     OR p_job_id !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+     OR p_idempotency_key IS NULL
+     OR p_idempotency_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$'
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length('cron:' || p_job_id || ':') + 24
+     OR pg_catalog.left(
+          p_idempotency_key,
+          pg_catalog.char_length('cron:' || p_job_id || ':')
+        ) IS DISTINCT FROM 'cron:' || p_job_id || ':'
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR p_claim_id IS NULL
+     OR p_claim_id !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+     OR p_evidence IS NULL
+     OR pg_catalog.jsonb_typeof(p_evidence) IS DISTINCT FROM 'object'
+     OR pg_catalog.octet_length(p_evidence::text) > 65536 THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  SELECT pg_catalog.count(*) = 6
+         AND pg_catalog.bool_and(
+           envelope_key = ANY (ARRAY[
+             'commitment_id', 'status', 'started_at', 'duration_ms',
+             'output_digest', 'metadata'
+           ]::text[])
+         )
+    INTO envelope_shape_ok
+    FROM pg_catalog.jsonb_object_keys(p_evidence) AS envelope_keys(envelope_key);
+
+  IF envelope_shape_ok IS NOT TRUE
+     OR pg_catalog.jsonb_typeof(p_evidence->'commitment_id') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(p_evidence->'status') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(p_evidence->'started_at') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(p_evidence->'duration_ms') IS DISTINCT FROM 'number'
+     OR pg_catalog.jsonb_typeof(p_evidence->'output_digest') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(p_evidence->'metadata') IS DISTINCT FROM 'object' THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  p_commitment_id := p_evidence->>'commitment_id';
+  status_value := p_evidence->>'status';
+  started_at_text := p_evidence->>'started_at';
+  output_digest_value := p_evidence->>'output_digest';
+  metadata_value := p_evidence->'metadata';
+
+  IF p_commitment_id IS NULL
+     OR p_commitment_id !~ '^cmt-hive-cron-v2-[a-f0-9]{64}$'
+     OR status_value IS NULL
+     OR status_value NOT IN ('success', 'skipped')
+     OR started_at_text IS NULL
+     OR started_at_text !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR (p_evidence->>'duration_ms') IS NULL
+     OR (p_evidence->>'duration_ms') !~ '^(0|[1-9][0-9]{0,7})$'
+     OR (p_evidence->>'duration_ms')::bigint > 86400000
+     OR output_digest_value IS NULL
+     OR output_digest_value !~ '^sha256:[a-f0-9]{64}$' THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  BEGIN
+    started_at_value := started_at_text::timestamptz;
+  EXCEPTION WHEN OTHERS THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END;
+  IF pg_catalog.to_char(
+       started_at_value AT TIME ZONE 'UTC',
+       'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+     ) IS DISTINCT FROM started_at_text THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  duration_ms_value := (p_evidence->>'duration_ms')::integer;
+  completed_at_value := started_at_value + duration_ms_value * '1 millisecond'::interval;
+  stage_value := metadata_value->>'cron_parity_stage';
+
+  SELECT pg_catalog.count(*) = CASE WHEN stage_value = 'shadow' THEN 28 ELSE 24 END
+         AND pg_catalog.bool_and(
+           metadata_key = ANY (
+             CASE WHEN stage_value = 'shadow' THEN ARRAY[
+               'cron_parity_runtime', 'cron_parity_stage', 'source_hash',
+               'expected_outcome_digest', 'scheduled_at', 'idempotency_key',
+               'occurrence_origin', 'enabled_at_claim', 'claim_id', 'lease_acquired',
+               'relay_required', 'relay_outcome', 'relay_request_digest', 'facts_digest',
+               'duration_ms', 'action_kind', 'action_version', 'action_contract_digest',
+               'resource_scopes', 'destination', 'timeout_seconds',
+               'idempotency_key_template', 'template_updated_at', 'run_status',
+               'shadow_cursor', 'enqueued', 'delivered', 'side_effects'
+             ]::text[] ELSE ARRAY[
+               'cron_parity_runtime', 'cron_parity_stage', 'source_hash',
+               'expected_outcome_digest', 'scheduled_at', 'idempotency_key',
+               'occurrence_origin', 'enabled_at_claim', 'claim_id', 'lease_acquired',
+               'relay_required', 'relay_outcome', 'relay_request_digest', 'facts_digest',
+               'duration_ms', 'action_kind', 'action_version', 'action_contract_digest',
+               'resource_scopes', 'destination', 'timeout_seconds',
+               'idempotency_key_template', 'template_updated_at', 'run_status'
+             ]::text[] END
+           )
+         )
+    INTO metadata_shape_ok
+    FROM pg_catalog.jsonb_object_keys(metadata_value) AS metadata_keys(metadata_key);
+
+  IF metadata_shape_ok IS NOT TRUE
+     OR pg_catalog.jsonb_typeof(metadata_value->'cron_parity_runtime') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'cron_parity_stage') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'source_hash') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'expected_outcome_digest') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'scheduled_at') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'idempotency_key') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'occurrence_origin') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'enabled_at_claim') IS DISTINCT FROM 'boolean'
+     OR pg_catalog.jsonb_typeof(metadata_value->'claim_id') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'lease_acquired') IS DISTINCT FROM 'boolean'
+     OR pg_catalog.jsonb_typeof(metadata_value->'relay_required') IS DISTINCT FROM 'boolean'
+     OR pg_catalog.jsonb_typeof(metadata_value->'relay_outcome') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'facts_digest') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'duration_ms') IS DISTINCT FROM 'number'
+     OR pg_catalog.jsonb_typeof(metadata_value->'action_kind') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'action_version') IS DISTINCT FROM 'number'
+     OR pg_catalog.jsonb_typeof(metadata_value->'action_contract_digest') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'resource_scopes') IS DISTINCT FROM 'array'
+     OR pg_catalog.jsonb_typeof(metadata_value->'destination') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'timeout_seconds') IS DISTINCT FROM 'number'
+     OR pg_catalog.jsonb_typeof(metadata_value->'idempotency_key_template') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'template_updated_at') IS DISTINCT FROM 'string'
+     OR pg_catalog.jsonb_typeof(metadata_value->'run_status') IS DISTINCT FROM 'string'
+     OR metadata_value->>'cron_parity_runtime' IS DISTINCT FROM 'hive-cron-v2'
+     OR stage_value IS NULL
+     OR stage_value NOT IN ('manual', 'shadow', 'scheduled_primary')
+     OR metadata_value->>'scheduled_at' IS DISTINCT FROM started_at_text
+     OR metadata_value->>'idempotency_key' IS DISTINCT FROM p_idempotency_key
+     OR metadata_value->>'claim_id' IS DISTINCT FROM p_claim_id
+     OR metadata_value->'lease_acquired' IS DISTINCT FROM 'true'::jsonb
+     OR metadata_value->>'facts_digest' IS DISTINCT FROM output_digest_value
+     OR metadata_value->'duration_ms' IS DISTINCT FROM p_evidence->'duration_ms'
+     OR metadata_value->>'run_status' IS DISTINCT FROM status_value
+     OR metadata_value->>'idempotency_key_template'
+          IS DISTINCT FROM 'cron:' || p_job_id || ':{scheduled_for}'
+     OR metadata_value->>'template_updated_at' IS NULL
+     OR metadata_value->>'template_updated_at'
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$' THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  IF stage_value = 'manual' AND NOT (
+       metadata_value->>'occurrence_origin' IS NOT DISTINCT FROM 'manual'
+       AND metadata_value->'enabled_at_claim' IS NOT DISTINCT FROM 'false'::jsonb
+       AND status_value = 'success'
+     ) THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  ELSIF stage_value = 'scheduled_primary' AND NOT (
+       metadata_value->>'occurrence_origin' IS NOT DISTINCT FROM 'scheduled'
+       AND metadata_value->'enabled_at_claim' IS NOT DISTINCT FROM 'true'::jsonb
+       AND status_value = 'success'
+     ) THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  ELSIF stage_value = 'shadow' AND NOT (
+       pg_catalog.jsonb_typeof(metadata_value->'shadow_cursor') IS NOT DISTINCT FROM 'string'
+       AND pg_catalog.jsonb_typeof(metadata_value->'enqueued') IS NOT DISTINCT FROM 'boolean'
+       AND pg_catalog.jsonb_typeof(metadata_value->'delivered') IS NOT DISTINCT FROM 'boolean'
+       AND pg_catalog.jsonb_typeof(metadata_value->'side_effects') IS NOT DISTINCT FROM 'boolean'
+       AND metadata_value->>'occurrence_origin' IS NOT DISTINCT FROM 'shadow'
+       AND metadata_value->'enabled_at_claim' IS NOT DISTINCT FROM 'false'::jsonb
+       AND status_value = 'skipped'
+       AND metadata_value->'relay_required' IS NOT DISTINCT FROM 'false'::jsonb
+       AND metadata_value->>'shadow_cursor' ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+       AND metadata_value->'enqueued' IS NOT DISTINCT FROM 'false'::jsonb
+       AND metadata_value->'delivered' IS NOT DISTINCT FROM 'false'::jsonb
+       AND metadata_value->'side_effects' IS NOT DISTINCT FROM 'false'::jsonb
+     ) THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  IF metadata_value->'relay_required' IS NOT DISTINCT FROM 'true'::jsonb THEN
+    IF pg_catalog.jsonb_typeof(metadata_value->'relay_request_digest') IS DISTINCT FROM 'string'
+       OR metadata_value->>'relay_outcome' IS DISTINCT FROM 'delivered'
+       OR metadata_value->>'relay_request_digest' !~ '^[a-f0-9]{64}$' THEN
+      RETURN QUERY SELECT 'relay_evidence_not_terminal'::text, NULL::text;
+      RETURN;
+    END IF;
+  ELSIF metadata_value->'relay_required' IS NOT DISTINCT FROM 'false'::jsonb THEN
+    IF pg_catalog.jsonb_typeof(metadata_value->'relay_request_digest') IS DISTINCT FROM 'null'
+       OR metadata_value->>'relay_outcome' IS DISTINCT FROM 'suppressed'
+       OR metadata_value->'relay_request_digest' IS DISTINCT FROM 'null'::jsonb THEN
+      RETURN QUERY SELECT 'relay_evidence_not_terminal'::text, NULL::text;
+      RETURN;
+    END IF;
+  ELSE
+    RETURN QUERY SELECT 'relay_evidence_not_terminal'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  SELECT job.name, job.schedule::text AS schedule_expr, job.runtime_source
+    INTO job_row
+    FROM semicolony.bot_cron_jobs AS job
+   WHERE job.bot_id = 'semi'
+     AND job.job_id = p_job_id
+   FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'evidence_job_not_found'::text, NULL::text;
+    RETURN;
+  END IF;
+  IF job_row.runtime_source IS DISTINCT FROM 'hive-cron-v2' THEN
+    RETURN QUERY SELECT 'evidence_job_runtime_mismatch'::text, NULL::text;
+    RETURN;
+  END IF;
+  IF job_row.name IS NULL OR job_row.schedule_expr IS NULL THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  SELECT template.*
+    INTO template_row
+    FROM semicolony.cron_capability_templates AS template
+   WHERE template.bot_id = 'semi'
+     AND template.job_id = p_job_id
+     AND template.runtime_source = 'hive-cron-v2'
+     AND template.action_kind IS NOT NULL
+     AND template.action_version IS NOT NULL
+     AND template.action_contract_digest IS NOT NULL
+   FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'current_template_not_found'::text, NULL::text;
+    RETURN;
+  END IF;
+  BEGIN
+    IF template_row.permission IS DISTINCT FROM 'read'
+       OR metadata_value->'resource_scopes'
+            IS DISTINCT FROM pg_catalog.to_jsonb(template_row.resource_scopes)
+       OR metadata_value->>'destination' IS DISTINCT FROM template_row.destination
+       OR (metadata_value->>'timeout_seconds')::integer
+            IS DISTINCT FROM template_row.timeout_seconds
+       OR metadata_value->>'idempotency_key_template'
+            IS DISTINCT FROM template_row.idempotency_key_template
+       OR metadata_value->>'expected_outcome_digest'
+            IS DISTINCT FROM template_row.expected_outcome_digest
+       OR metadata_value->>'source_hash' IS DISTINCT FROM template_row.source_hash
+       OR metadata_value->>'action_kind' IS DISTINCT FROM template_row.action_kind
+       OR (metadata_value->>'action_version')::integer
+            IS DISTINCT FROM template_row.action_version
+       OR metadata_value->>'action_contract_digest'
+            IS DISTINCT FROM template_row.action_contract_digest
+       OR (metadata_value->>'template_updated_at')::timestamptz
+            IS DISTINCT FROM template_row.updated_at
+       OR duration_ms_value > template_row.timeout_seconds * 1000 THEN
+      RETURN QUERY SELECT 'current_template_changed'::text, NULL::text;
+      RETURN;
+    END IF;
+  EXCEPTION WHEN OTHERS THEN
+    RETURN QUERY SELECT 'current_template_changed'::text, NULL::text;
+    RETURN;
+  END;
+
+  SELECT lease.*
+    INTO lease_row
+    FROM semicolony.cron_read_action_occurrence_leases AS lease
+   WHERE lease.idempotency_key = p_idempotency_key
+   FOR UPDATE;
+
+  IF NOT FOUND OR lease_row.claim_id IS DISTINCT FROM p_claim_id THEN
+    RETURN QUERY SELECT 'occurrence_lease_not_owned'::text, NULL::text;
+    RETURN;
+  END IF;
+  IF lease_row.state IS NULL
+     OR lease_row.state NOT IN ('acquired', 'completed')
+     OR (lease_row.state = 'acquired' AND lease_row.completed_at IS NOT NULL)
+     OR (lease_row.state = 'completed' AND lease_row.completed_at IS NULL) THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  SELECT outbox.*
+    INTO outbox_row
+    FROM semicolony.cron_read_action_relay_outbox AS outbox
+   WHERE outbox.idempotency_key = p_idempotency_key
+   FOR UPDATE;
+  outbox_exists := FOUND;
+
+  IF metadata_value->'relay_required' IS NOT DISTINCT FROM 'true'::jsonb THEN
+    IF NOT outbox_exists
+       OR outbox_row.request_digest IS DISTINCT FROM metadata_value->>'relay_request_digest'
+       OR outbox_row.state IS DISTINCT FROM 'completed'
+       OR outbox_row.outcome_status IS DISTINCT FROM 'delivered'
+       OR outbox_row.outcome_status IS DISTINCT FROM metadata_value->>'relay_outcome'
+       OR outbox_row.error_code IS NOT NULL
+       OR outbox_row.completed_at IS NULL THEN
+      RETURN QUERY SELECT 'relay_evidence_not_terminal'::text, NULL::text;
+      RETURN;
+    END IF;
+  ELSIF outbox_exists THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  SELECT evidence.*
+    INTO commitment_row
+    FROM semicolony.bot_commitments AS evidence
+   WHERE evidence.bot_id = 'semi'
+     AND evidence.source_type = 'cron'
+     AND evidence.runtime_source = 'hive-cron-v2'
+     AND evidence.metadata->>'cron_parity_runtime' = 'hive-cron-v2'
+     AND evidence.metadata->>'idempotency_key' = p_idempotency_key
+   FOR UPDATE;
+  commitment_exists := FOUND;
+
+  SELECT event.*
+    INTO event_row
+    FROM semicolony.commitment_events AS event
+   WHERE event.idempotency_key = 'cron:' || p_commitment_id
+   FOR UPDATE;
+  event_exists := FOUND;
+
+  expected_pipeline_context := pg_catalog.jsonb_build_object(
+    'job_id', p_job_id,
+    'job_name', job_row.name,
+    'schedule_expr', job_row.schedule_expr,
+    'scheduled_at', started_at_text
+  );
+  expected_commitment_metadata := metadata_value || pg_catalog.jsonb_build_object(
+    'output_digest', output_digest_value
+  );
+  expected_event_payload := pg_catalog.jsonb_build_object(
+    'run_status', status_value,
+    'duration_ms', duration_ms_value,
+    'job_id', p_job_id,
+    'job_name', job_row.name,
+    'schedule_expr', job_row.schedule_expr,
+    'error', NULL,
+    'output_digest', output_digest_value,
+    'occurrence_idempotency_key', p_idempotency_key
+  );
+  expected_title := 'cron: ' || job_row.name;
+  expected_description := 'schedule=' || job_row.schedule_expr
+    || ' run_status=' || status_value
+    || ' duration=' || duration_ms_value::text || 'ms';
+
+  IF lease_row.state IS NOT DISTINCT FROM 'completed' THEN
+    IF lease_row.completed_at IS DISTINCT FROM completed_at_value
+       OR NOT commitment_exists
+       OR NOT event_exists
+       OR commitment_row.id IS DISTINCT FROM p_commitment_id
+       OR commitment_row.bot_id IS DISTINCT FROM 'semi'
+       OR commitment_row.status IS DISTINCT FROM 'done'
+       OR commitment_row.title IS DISTINCT FROM expected_title
+       OR commitment_row.description IS DISTINCT FROM expected_description
+       OR commitment_row.source_type IS DISTINCT FROM 'cron'
+       OR commitment_row.source_ref IS DISTINCT FROM 'cron:' || p_job_id
+       OR commitment_row.deadline_at IS DISTINCT FROM NULL
+       OR commitment_row.steps IS DISTINCT FROM '[]'::jsonb
+       OR commitment_row.assigned_session IS DISTINCT FROM 'semi-cron-local'
+       OR commitment_row.session_owner IS DISTINCT FROM 'semi-cron-local'
+       OR commitment_row.pipeline_context IS DISTINCT FROM expected_pipeline_context
+       OR commitment_row.metadata IS DISTINCT FROM expected_commitment_metadata
+       OR commitment_row.last_heartbeat_at IS DISTINCT FROM completed_at_value
+       OR commitment_row.completed_at IS DISTINCT FROM completed_at_value
+       OR commitment_row.created_at IS DISTINCT FROM started_at_value
+       OR commitment_row.updated_at IS DISTINCT FROM completed_at_value
+       OR commitment_row.runtime_source IS DISTINCT FROM 'hive-cron-v2'
+       OR commitment_row.tenant_id IS DISTINCT FROM NULL
+       OR commitment_row.scope IS DISTINCT FROM 'platform-global'
+       OR commitment_row.install_id IS DISTINCT FROM NULL
+       OR event_row.commitment_id IS DISTINCT FROM p_commitment_id
+       OR event_row.event_type IS DISTINCT FROM 'cron_run_recorded'
+       OR event_row.payload IS DISTINCT FROM expected_event_payload
+       OR event_row.occurred_at IS DISTINCT FROM completed_at_value
+       OR event_row.bot_id IS DISTINCT FROM 'semi'
+       OR event_row.source_type IS DISTINCT FROM 'cron'
+       OR event_row.runtime_source IS DISTINCT FROM 'hive-cron-v2'
+       OR event_row.idempotency_key IS DISTINCT FROM 'cron:' || p_commitment_id
+       OR event_row.event_id IS NULL
+       OR event_row.event_id <= 0
+       OR event_row.recorded_at IS DISTINCT FROM completed_at_value THEN
+      RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+      RETURN;
+    END IF;
+    RETURN QUERY SELECT 'existing'::text, p_commitment_id;
+    RETURN;
+  END IF;
+
+  IF commitment_exists OR event_exists THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END IF;
+
+  BEGIN
+    INSERT INTO semicolony.bot_commitments (
+      id, bot_id, status, title, description, source_type, source_ref,
+      deadline_at, steps, assigned_session, session_owner, pipeline_context, metadata,
+      last_heartbeat_at, completed_at, created_at, updated_at, runtime_source,
+      tenant_id, scope, install_id
+    ) VALUES (
+      p_commitment_id, 'semi', 'done', expected_title, expected_description,
+      'cron', 'cron:' || p_job_id, NULL, '[]'::jsonb,
+      'semi-cron-local', 'semi-cron-local', expected_pipeline_context,
+      expected_commitment_metadata, completed_at_value, completed_at_value,
+      started_at_value, completed_at_value, 'hive-cron-v2',
+      NULL, 'platform-global', NULL
+    );
+
+    INSERT INTO semicolony.commitment_events (
+      commitment_id, event_type, payload, occurred_at, recorded_at, bot_id, source_type,
+      runtime_source, idempotency_key
+    ) VALUES (
+      p_commitment_id, 'cron_run_recorded', expected_event_payload,
+      completed_at_value, completed_at_value, 'semi', 'cron', 'hive-cron-v2',
+      'cron:' || p_commitment_id
+    );
+
+    IF stage_value = 'scheduled_primary' THEN
+      UPDATE semicolony.bot_cron_jobs AS job
+         SET last_run = completed_at_value,
+             last_status = 'success',
+             last_error = NULL,
+             consecutive_failures = 0
+       WHERE job.bot_id = 'semi'
+         AND job.job_id = p_job_id
+         AND job.runtime_source = 'hive-cron-v2';
+      GET DIAGNOSTICS affected_count = ROW_COUNT;
+      IF affected_count IS DISTINCT FROM 1 THEN
+        RAISE EXCEPTION 'evidence_state_conflict' USING ERRCODE = 'P0001';
+      END IF;
+    END IF;
+
+    UPDATE semicolony.cron_read_action_occurrence_leases AS lease
+       SET state = 'completed',
+           completed_at = completed_at_value
+     WHERE lease.idempotency_key = p_idempotency_key
+       AND lease.claim_id = p_claim_id
+       AND lease.state = 'acquired'
+       AND lease.completed_at IS NULL;
+    GET DIAGNOSTICS affected_count = ROW_COUNT;
+    IF affected_count IS DISTINCT FROM 1 THEN
+      RAISE EXCEPTION 'evidence_state_conflict' USING ERRCODE = 'P0001';
+    END IF;
+  EXCEPTION WHEN SQLSTATE 'P0001' THEN
+    RETURN QUERY SELECT 'evidence_state_conflict'::text, NULL::text;
+    RETURN;
+  END;
+
+  RETURN QUERY SELECT 'inserted'::text, p_commitment_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_get_template(text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_lock_authority(text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_reconcile(text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_write_evidence(text, text, text, jsonb)
+  FROM PUBLIC, sc_app, sc_provider;
+
+DO $$
+DECLARE
+  role_state record;
+BEGIN
+  SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole,
+         rolinherit, rolreplication, rolbypassrls
+    INTO role_state
+    FROM pg_catalog.pg_roles
+   WHERE rolname = 'sc_provider';
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'sc_provider role missing; migration 135 required';
+  END IF;
+
+  IF NOT role_state.rolcanlogin
+     OR role_state.rolsuper
+     OR role_state.rolcreatedb
+     OR role_state.rolcreaterole
+     OR role_state.rolinherit
+     OR role_state.rolreplication
+     OR role_state.rolbypassrls THEN
+    RAISE EXCEPTION 'sc_provider role attributes are unsafe';
+  END IF;
+
+END $$;
+
+REVOKE ALL PRIVILEGES ON TABLE
+  semicolony.bot_cron_jobs,
+  semicolony.cron_capability_templates,
+  semicolony.cron_read_action_occurrence_leases,
+  semicolony.cron_read_action_relay_outbox,
+  semicolony.bot_commitments,
+  semicolony.commitment_events
+FROM sc_provider;
+
+REVOKE ALL PRIVILEGES
+  ON SEQUENCE semicolony.commitment_events_event_id_seq
+  FROM sc_provider;
+
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_get_template(text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_lock_authority(text, text, text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_reconcile(text, text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_write_evidence(text, text, text, jsonb)
+  TO sc_provider;