@team-semicolon/semicolony-cli 4.18.51 → 4.18.52

package/migrations/159_hive_cron_shadow_cursor.sql

@@ -0,0 +1,600 @@
+-- @schema-retarget: off
+-- Independent, side-effect-free Hive cron shadow cursors and bounded observations.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+DO $$
+DECLARE
+  role_state record;
+BEGIN
+  SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole,
+         rolinherit, rolreplication, rolbypassrls
+    INTO role_state
+    FROM pg_roles
+   WHERE rolname = 'sc_provider';
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'sc_provider role missing; migration 135 required';
+  END IF;
+  IF NOT role_state.rolcanlogin
+     OR role_state.rolsuper
+     OR role_state.rolcreatedb
+     OR role_state.rolcreaterole
+     OR role_state.rolinherit
+     OR role_state.rolreplication
+     OR role_state.rolbypassrls THEN
+    RAISE EXCEPTION 'sc_provider role attributes are unsafe';
+  END IF;
+END $$;
+
+CREATE FUNCTION semicolony.hive_cron_shadow_sha256(p_value text)
+RETURNS text
+LANGUAGE sql
+IMMUTABLE
+STRICT
+SECURITY DEFINER
+SET search_path = pg_catalog
+SET TimeZone = 'UTC'
+AS $$
+  SELECT 'sha256:' || pg_catalog.encode(
+    pg_catalog.sha256(pg_catalog.convert_to(p_value, 'UTF8')),
+    'hex'
+  );
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_shadow_sha256(text)
+  FROM PUBLIC, sc_app, sc_provider;
+
+CREATE TABLE semicolony.hive_cron_shadow_cursors (
+  bot_id                 TEXT NOT NULL CHECK (bot_id = 'semi'),
+  job_id                 TEXT NOT NULL CHECK (
+    (job_id COLLATE "C") ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+  ),
+  runtime_source         TEXT NOT NULL CHECK (runtime_source = 'hive-cron-v2'),
+  cursor_version         BIGINT NOT NULL CHECK (cursor_version > 0),
+  next_scheduled_for     TIMESTAMPTZ NOT NULL,
+  schedule_digest        TEXT NOT NULL CHECK (schedule_digest ~ '^sha256:[a-f0-9]{64}$'),
+  template_digest        TEXT NOT NULL CHECK (template_digest ~ '^sha256:[a-f0-9]{64}$'),
+  binding_digest         TEXT NOT NULL CHECK (binding_digest ~ '^sha256:[a-f0-9]{64}$'),
+  created_at             TIMESTAMPTZ NOT NULL,
+  updated_at             TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (bot_id, job_id, runtime_source),
+  FOREIGN KEY (bot_id, job_id, runtime_source)
+    REFERENCES semicolony.cron_capability_templates (bot_id, job_id, runtime_source)
+);
+
+COMMENT ON TABLE semicolony.hive_cron_shadow_cursors IS
+  'Independent Hive shadow schedule cursor; never copies or advances primary next_run.';
+
+CREATE TABLE semicolony.hive_cron_shadow_observations (
+  observation_id               TEXT PRIMARY KEY CHECK (
+    observation_id = 'shadow-' || pg_catalog.substr(
+      semicolony.hive_cron_shadow_sha256(
+        bot_id || E'\n' || job_id || E'\n' || runtime_source || E'\n' || after_cursor_version::text
+      ),
+      8
+    )
+  ),
+  bot_id                       TEXT NOT NULL CHECK (bot_id = 'semi'),
+  job_id                       TEXT NOT NULL CHECK (
+    (job_id COLLATE "C") ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+  ),
+  runtime_source               TEXT NOT NULL CHECK (runtime_source = 'hive-cron-v2'),
+  transition                   TEXT NOT NULL CHECK (transition IN ('initialized', 'advanced')),
+  before_cursor_version        BIGINT,
+  before_next_scheduled_for    TIMESTAMPTZ,
+  after_cursor_version         BIGINT NOT NULL CHECK (after_cursor_version > 0),
+  after_next_scheduled_for     TIMESTAMPTZ NOT NULL,
+  observed_at                  TIMESTAMPTZ NOT NULL,
+  due_count                    INTEGER NOT NULL CHECK (due_count BETWEEN 0 AND 512),
+  skipped_count                INTEGER NOT NULL CHECK (skipped_count BETWEEN 0 AND 511),
+  enabled                      BOOLEAN NOT NULL,
+  schedule_digest              TEXT NOT NULL CHECK (schedule_digest ~ '^sha256:[a-f0-9]{64}$'),
+  template_digest              TEXT NOT NULL CHECK (template_digest ~ '^sha256:[a-f0-9]{64}$'),
+  binding_digest               TEXT NOT NULL CHECK (binding_digest ~ '^sha256:[a-f0-9]{64}$'),
+  occurrence_digest            TEXT NOT NULL CHECK (occurrence_digest ~ '^sha256:[a-f0-9]{64}$'),
+  observation_digest           TEXT NOT NULL CHECK (observation_digest ~ '^sha256:[a-f0-9]{64}$'),
+  UNIQUE (bot_id, job_id, runtime_source, after_cursor_version),
+  FOREIGN KEY (bot_id, job_id, runtime_source)
+    REFERENCES semicolony.cron_capability_templates (bot_id, job_id, runtime_source),
+  CHECK (after_next_scheduled_for > observed_at),
+  CHECK (
+    (
+      transition = 'initialized'
+      AND before_cursor_version IS NULL
+      AND before_next_scheduled_for IS NULL
+      AND after_cursor_version = 1
+      AND due_count = 0
+      AND skipped_count = 0
+    )
+    OR
+    (
+      transition = 'advanced'
+      AND before_cursor_version IS NOT NULL
+      AND before_cursor_version > 0
+      AND before_next_scheduled_for IS NOT NULL
+      AND before_next_scheduled_for <= observed_at
+      AND after_cursor_version = before_cursor_version + 1
+      AND due_count BETWEEN 1 AND 512
+      AND skipped_count = due_count - 1
+    )
+  )
+);
+
+COMMENT ON TABLE semicolony.hive_cron_shadow_observations IS
+  'Append-only bounded shadow cursor transitions without raw schedules, templates, or payloads.';
+
+ALTER TABLE semicolony.hive_cron_shadow_cursors
+  ADD CONSTRAINT hive_cron_shadow_cursor_current_observation_fk
+  FOREIGN KEY (bot_id, job_id, runtime_source, cursor_version)
+  REFERENCES semicolony.hive_cron_shadow_observations
+    (bot_id, job_id, runtime_source, after_cursor_version)
+  DEFERRABLE INITIALLY DEFERRED;
+
+CREATE FUNCTION semicolony.hive_cron_protect_shadow_observation()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+SET TimeZone = 'UTC'
+AS $$
+BEGIN
+  RAISE EXCEPTION 'shadow_observation_immutable' USING ERRCODE = '55000';
+END;
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_protect_shadow_observation()
+  FROM PUBLIC, sc_app, sc_provider;
+
+CREATE TRIGGER protect_hive_cron_shadow_observation
+BEFORE UPDATE OR DELETE ON semicolony.hive_cron_shadow_observations
+FOR EACH ROW EXECUTE FUNCTION semicolony.hive_cron_protect_shadow_observation();
+
+CREATE FUNCTION semicolony.hive_cron_advance_shadow(p_now timestamptz)
+RETURNS TABLE (
+  transition text,
+  observation_id text,
+  bot_id text,
+  job_id text,
+  runtime_source text,
+  before_cursor_version bigint,
+  before_next_scheduled_for timestamptz,
+  after_cursor_version bigint,
+  after_next_scheduled_for timestamptz,
+  observed_at timestamptz,
+  due_count integer,
+  skipped_count integer,
+  enabled boolean,
+  schedule_digest text,
+  template_digest text,
+  binding_digest text,
+  occurrence_digest text,
+  observation_digest text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+SET TimeZone = 'UTC'
+AS $$
+DECLARE
+  candidate record;
+  candidates jsonb;
+  cursor_state record;
+  db_now timestamptz;
+  first_future timestamptz;
+  second_future timestamptz;
+  occurrence timestamptz;
+  previous_occurrence timestamptz;
+  occurrence_lines text[];
+  transition_value text;
+  observation_id_value text;
+  before_cursor_version_value bigint;
+  before_next_scheduled_for_value timestamptz;
+  after_cursor_version_value bigint;
+  after_next_scheduled_for_value timestamptz;
+  due_count_value integer;
+  skipped_count_value integer;
+  occurrence_digest_value text;
+  observation_digest_value text;
+  changed integer;
+BEGIN
+  IF session_user <> 'sc_provider'
+     OR public.is_provider() IS DISTINCT FROM true THEN
+    RAISE EXCEPTION 'provider_mode_required' USING ERRCODE = '42501';
+  END IF;
+
+  PERFORM pg_catalog.pg_advisory_xact_lock(
+    pg_catalog.hashtextextended('semicolony.hive_cron_shadow_cursor', 0)
+  );
+  db_now := pg_catalog.clock_timestamp();
+  IF p_now IS NULL
+     OR p_now < db_now - interval '30 seconds'
+     OR p_now > db_now + interval '30 seconds' THEN
+    RAISE EXCEPTION 'invalid_shadow_clock' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT COALESCE(
+           pg_catalog.jsonb_agg(
+             pg_catalog.jsonb_build_object(
+               'bot_id', candidate_source.bot_id,
+               'job_id', candidate_source.job_id,
+               'runtime_source', candidate_source.runtime_source,
+               'job_runtime_source', candidate_source.job_runtime_source,
+               'schedule', candidate_source.schedule,
+               'enabled', candidate_source.enabled,
+               'schedule_digest', candidate_source.schedule_digest,
+               'template_digest', candidate_source.template_digest,
+               'binding_digest', semicolony.hive_cron_shadow_sha256(
+                 candidate_source.schedule_digest || E'\n' ||
+                 candidate_source.template_digest
+               )
+             ) ORDER BY candidate_source.job_id COLLATE "C"
+           ),
+           '[]'::jsonb
+         )
+    INTO candidates
+    FROM (
+      SELECT template.bot_id,
+             template.job_id,
+             template.runtime_source,
+             job.runtime_source AS job_runtime_source,
+             job.schedule,
+             job.enabled,
+             digests.schedule_digest,
+             digests.template_digest
+        FROM (
+          SELECT template_bound.*
+            FROM semicolony.cron_capability_templates AS template_bound
+           WHERE template_bound.bot_id = 'semi'
+             AND template_bound.runtime_source = 'hive-cron-v2'
+           ORDER BY template_bound.job_id COLLATE "C"
+           LIMIT 21
+        ) AS template
+        LEFT JOIN semicolony.bot_cron_jobs AS job
+          ON job.bot_id = template.bot_id
+         AND job.job_id = template.job_id
+        CROSS JOIN LATERAL (
+          SELECT semicolony.hive_cron_shadow_sha256(job.schedule::text) AS schedule_digest,
+                 semicolony.hive_cron_shadow_sha256(
+                   pg_catalog.to_jsonb(template)::text
+                 ) AS template_digest
+        ) AS digests
+    ) AS candidate_source;
+
+  IF pg_catalog.jsonb_array_length(candidates) > 20 THEN
+    RAISE EXCEPTION 'shadow_candidate_limit_exceeded' USING ERRCODE = '54000';
+  END IF;
+
+  FOR candidate IN
+    SELECT candidate_row.*
+      FROM pg_catalog.jsonb_to_recordset(candidates) AS candidate_row(
+        bot_id text,
+        job_id text,
+        runtime_source text,
+        job_runtime_source text,
+        schedule jsonb,
+        enabled boolean,
+        schedule_digest text,
+        template_digest text,
+        binding_digest text
+      )
+     ORDER BY candidate_row.job_id COLLATE "C"
+  LOOP
+    IF candidate.job_runtime_source IS DISTINCT FROM candidate.runtime_source THEN
+      RAISE EXCEPTION 'shadow_binding_drift' USING ERRCODE = '40001';
+    END IF;
+    SELECT cursor.schedule_digest,
+           cursor.template_digest,
+           cursor.binding_digest
+      INTO cursor_state
+      FROM semicolony.hive_cron_shadow_cursors AS cursor
+     WHERE cursor.bot_id = candidate.bot_id
+       AND cursor.job_id = candidate.job_id
+       AND cursor.runtime_source = candidate.runtime_source;
+    IF FOUND AND (
+      cursor_state.schedule_digest IS DISTINCT FROM candidate.schedule_digest
+      OR cursor_state.template_digest IS DISTINCT FROM candidate.template_digest
+      OR cursor_state.binding_digest IS DISTINCT FROM candidate.binding_digest
+    ) THEN
+      RAISE EXCEPTION 'shadow_binding_drift' USING ERRCODE = '40001';
+    END IF;
+    BEGIN
+      first_future := semicolony.hive_cron_derive_next_run(candidate.schedule, db_now);
+      second_future := semicolony.hive_cron_derive_next_run(candidate.schedule, first_future);
+    EXCEPTION
+      WHEN SQLSTATE '22023' THEN
+        RAISE EXCEPTION 'shadow_schedule_frequency_invalid' USING ERRCODE = '22023';
+    END;
+    IF first_future <= db_now
+       OR second_future <= first_future
+       OR second_future - first_future < interval '30 minutes' THEN
+      RAISE EXCEPTION 'shadow_schedule_frequency_invalid' USING ERRCODE = '22023';
+    END IF;
+  END LOOP;
+
+  FOR candidate IN
+    SELECT candidate_row.*
+      FROM pg_catalog.jsonb_to_recordset(candidates) AS candidate_row(
+        bot_id text,
+        job_id text,
+        runtime_source text,
+        job_runtime_source text,
+        schedule jsonb,
+        enabled boolean,
+        schedule_digest text,
+        template_digest text,
+        binding_digest text
+      )
+     ORDER BY candidate_row.job_id COLLATE "C"
+  LOOP
+    SELECT cursor.cursor_version,
+           cursor.next_scheduled_for,
+           cursor.schedule_digest,
+           cursor.template_digest,
+           cursor.binding_digest
+      INTO cursor_state
+      FROM semicolony.hive_cron_shadow_cursors AS cursor
+     WHERE cursor.bot_id = candidate.bot_id
+       AND cursor.job_id = candidate.job_id
+       AND cursor.runtime_source = candidate.runtime_source
+     FOR UPDATE;
+
+    occurrence_lines := ARRAY[]::text[];
+    due_count_value := 0;
+    skipped_count_value := 0;
+    before_cursor_version_value := NULL;
+    before_next_scheduled_for_value := NULL;
+
+    IF NOT FOUND THEN
+      transition_value := 'initialized';
+      after_cursor_version_value := 1;
+      after_next_scheduled_for_value := semicolony.hive_cron_derive_next_run(
+        candidate.schedule,
+        db_now
+      );
+      occurrence_digest_value := semicolony.hive_cron_shadow_sha256('');
+
+      INSERT INTO semicolony.hive_cron_shadow_cursors (
+        bot_id, job_id, runtime_source, cursor_version, next_scheduled_for,
+        schedule_digest, template_digest, binding_digest, created_at, updated_at
+      ) VALUES (
+        candidate.bot_id, candidate.job_id, candidate.runtime_source,
+        after_cursor_version_value, after_next_scheduled_for_value,
+        candidate.schedule_digest, candidate.template_digest, candidate.binding_digest,
+        db_now, db_now
+      );
+    ELSE
+      IF cursor_state.schedule_digest IS DISTINCT FROM candidate.schedule_digest
+         OR cursor_state.template_digest IS DISTINCT FROM candidate.template_digest
+         OR cursor_state.binding_digest IS DISTINCT FROM candidate.binding_digest THEN
+        RAISE EXCEPTION 'shadow_binding_drift' USING ERRCODE = '40001';
+      END IF;
+      IF cursor_state.next_scheduled_for > db_now THEN
+        CONTINUE;
+      END IF;
+      IF db_now - cursor_state.next_scheduled_for > interval '8 days' THEN
+        RAISE EXCEPTION 'shadow_backlog_window_exceeded' USING ERRCODE = '54000';
+      END IF;
+
+      transition_value := 'advanced';
+      before_cursor_version_value := cursor_state.cursor_version;
+      before_next_scheduled_for_value := cursor_state.next_scheduled_for;
+      occurrence := cursor_state.next_scheduled_for;
+      WHILE occurrence <= db_now LOOP
+        due_count_value := due_count_value + 1;
+        IF due_count_value > 512 THEN
+          RAISE EXCEPTION 'shadow_occurrence_limit_exceeded' USING ERRCODE = '54000';
+        END IF;
+        occurrence_lines := pg_catalog.array_append(
+          occurrence_lines,
+          pg_catalog.to_char(
+            occurrence AT TIME ZONE 'UTC',
+            'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+          )
+        );
+        previous_occurrence := occurrence;
+        occurrence := semicolony.hive_cron_derive_next_run(candidate.schedule, occurrence);
+        IF occurrence <= previous_occurrence THEN
+          RAISE EXCEPTION 'shadow_non_monotonic_schedule' USING ERRCODE = '22023';
+        END IF;
+      END LOOP;
+
+      skipped_count_value := due_count_value - 1;
+      after_cursor_version_value := cursor_state.cursor_version + 1;
+      after_next_scheduled_for_value := occurrence;
+      occurrence_digest_value := semicolony.hive_cron_shadow_sha256(
+        pg_catalog.array_to_string(occurrence_lines, E'\n')
+      );
+
+      UPDATE semicolony.hive_cron_shadow_cursors AS cursor
+         SET cursor_version = after_cursor_version_value,
+             next_scheduled_for = after_next_scheduled_for_value,
+             updated_at = db_now
+       WHERE cursor.bot_id = candidate.bot_id
+         AND cursor.job_id = candidate.job_id
+         AND cursor.runtime_source = candidate.runtime_source
+         AND cursor.cursor_version = before_cursor_version_value
+         AND cursor.next_scheduled_for = before_next_scheduled_for_value
+         AND cursor.schedule_digest = candidate.schedule_digest
+         AND cursor.template_digest = candidate.template_digest
+         AND cursor.binding_digest = candidate.binding_digest;
+      GET DIAGNOSTICS changed = ROW_COUNT;
+      IF changed <> 1 THEN
+        RAISE EXCEPTION 'shadow_cursor_concurrent_change' USING ERRCODE = '40001';
+      END IF;
+    END IF;
+
+    observation_id_value := 'shadow-' || pg_catalog.substr(
+      semicolony.hive_cron_shadow_sha256(
+        candidate.bot_id || E'\n' || candidate.job_id || E'\n' ||
+        candidate.runtime_source || E'\n' || after_cursor_version_value::text
+      ),
+      8
+    );
+    observation_digest_value := semicolony.hive_cron_shadow_sha256(
+      transition_value || E'\n' ||
+      COALESCE(before_cursor_version_value::text, '') || E'\n' ||
+      COALESCE(pg_catalog.to_char(
+        before_next_scheduled_for_value AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'
+      ), '') || E'\n' ||
+      after_cursor_version_value::text || E'\n' ||
+      pg_catalog.to_char(
+        after_next_scheduled_for_value AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'
+      ) || E'\n' ||
+      pg_catalog.to_char(db_now AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') || E'\n' ||
+      due_count_value::text || E'\n' || skipped_count_value::text || E'\n' ||
+      candidate.enabled::text || E'\n' || candidate.schedule_digest || E'\n' ||
+      candidate.template_digest || E'\n' || candidate.binding_digest || E'\n' ||
+      occurrence_digest_value
+    );
+
+    INSERT INTO semicolony.hive_cron_shadow_observations (
+      observation_id, bot_id, job_id, runtime_source, transition,
+      before_cursor_version, before_next_scheduled_for,
+      after_cursor_version, after_next_scheduled_for, observed_at,
+      due_count, skipped_count, enabled, schedule_digest, template_digest,
+      binding_digest, occurrence_digest, observation_digest
+    ) VALUES (
+      observation_id_value, candidate.bot_id, candidate.job_id, candidate.runtime_source,
+      transition_value, before_cursor_version_value, before_next_scheduled_for_value,
+      after_cursor_version_value, after_next_scheduled_for_value, db_now,
+      due_count_value, skipped_count_value, candidate.enabled,
+      candidate.schedule_digest, candidate.template_digest, candidate.binding_digest,
+      occurrence_digest_value, observation_digest_value
+    );
+
+    transition := transition_value;
+    observation_id := observation_id_value;
+    bot_id := candidate.bot_id;
+    job_id := candidate.job_id;
+    runtime_source := candidate.runtime_source;
+    before_cursor_version := before_cursor_version_value;
+    before_next_scheduled_for := before_next_scheduled_for_value;
+    after_cursor_version := after_cursor_version_value;
+    after_next_scheduled_for := after_next_scheduled_for_value;
+    observed_at := db_now;
+    due_count := due_count_value;
+    skipped_count := skipped_count_value;
+    enabled := candidate.enabled;
+    schedule_digest := candidate.schedule_digest;
+    template_digest := candidate.template_digest;
+    binding_digest := candidate.binding_digest;
+    occurrence_digest := occurrence_digest_value;
+    observation_digest := observation_digest_value;
+    RETURN NEXT;
+  END LOOP;
+END;
+$$;
+
+CREATE FUNCTION semicolony.hive_cron_get_shadow_snapshot()
+RETURNS TABLE (
+  bot_id text,
+  job_id text,
+  runtime_source text,
+  cursor_version bigint,
+  next_scheduled_for timestamptz,
+  cursor_schedule_digest text,
+  cursor_template_digest text,
+  cursor_binding_digest text,
+  created_at timestamptz,
+  updated_at timestamptz,
+  observation_id text,
+  transition text,
+  observation_before_cursor_version bigint,
+  observation_before_next_scheduled_for timestamptz,
+  observation_after_cursor_version bigint,
+  observation_after_next_scheduled_for timestamptz,
+  observed_at timestamptz,
+  due_count integer,
+  skipped_count integer,
+  enabled boolean,
+  observation_schedule_digest text,
+  observation_template_digest text,
+  observation_binding_digest text,
+  occurrence_digest text,
+  observation_digest text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+SET TimeZone = 'UTC'
+AS $$
+BEGIN
+  IF session_user <> 'sc_provider'
+     OR public.is_provider() IS DISTINCT FROM true THEN
+    RAISE EXCEPTION 'provider_mode_required' USING ERRCODE = '42501';
+  END IF;
+
+  PERFORM pg_catalog.pg_advisory_xact_lock(
+    pg_catalog.hashtextextended('semicolony.hive_cron_shadow_cursor', 0)
+  );
+  IF EXISTS (
+    SELECT 1
+      FROM semicolony.hive_cron_shadow_cursors AS cursor
+      LEFT JOIN semicolony.hive_cron_shadow_observations AS observation
+        ON observation.bot_id = cursor.bot_id
+       AND observation.job_id = cursor.job_id
+       AND observation.runtime_source = cursor.runtime_source
+       AND observation.after_cursor_version = cursor.cursor_version
+     WHERE observation.observation_id IS NULL
+        OR cursor.cursor_version IS DISTINCT FROM observation.after_cursor_version
+        OR cursor.next_scheduled_for IS DISTINCT FROM observation.after_next_scheduled_for
+        OR cursor.updated_at IS DISTINCT FROM observation.observed_at
+        OR cursor.schedule_digest IS DISTINCT FROM observation.schedule_digest
+        OR cursor.template_digest IS DISTINCT FROM observation.template_digest
+        OR cursor.binding_digest IS DISTINCT FROM observation.binding_digest
+  ) THEN
+    RAISE EXCEPTION 'shadow_snapshot_incoherent' USING ERRCODE = '40001';
+  END IF;
+
+  RETURN QUERY
+  SELECT cursor.bot_id,
+         cursor.job_id,
+         cursor.runtime_source,
+         cursor.cursor_version,
+         cursor.next_scheduled_for,
+         cursor.schedule_digest,
+         cursor.template_digest,
+         cursor.binding_digest,
+         cursor.created_at,
+         cursor.updated_at,
+         observation.observation_id,
+         observation.transition,
+         observation.before_cursor_version,
+         observation.before_next_scheduled_for,
+         observation.after_cursor_version,
+         observation.after_next_scheduled_for,
+         observation.observed_at,
+         observation.due_count,
+         observation.skipped_count,
+         observation.enabled,
+         observation.schedule_digest,
+         observation.template_digest,
+         observation.binding_digest,
+         observation.occurrence_digest,
+         observation.observation_digest
+    FROM semicolony.hive_cron_shadow_cursors AS cursor
+    JOIN semicolony.hive_cron_shadow_observations AS observation
+      ON observation.bot_id = cursor.bot_id
+     AND observation.job_id = cursor.job_id
+     AND observation.runtime_source = cursor.runtime_source
+     AND observation.after_cursor_version = cursor.cursor_version
+   ORDER BY cursor.job_id COLLATE "C";
+END;
+$$;
+
+REVOKE ALL PRIVILEGES ON TABLE semicolony.hive_cron_shadow_cursors
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL PRIVILEGES ON TABLE semicolony.hive_cron_shadow_observations
+  FROM PUBLIC, sc_app, sc_provider;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_advance_shadow(timestamptz)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_get_shadow_snapshot()
+  FROM PUBLIC, sc_app, sc_provider;
+
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_advance_shadow(timestamptz)
+  TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_get_shadow_snapshot()
+  TO sc_provider;