@tokenoftrust/storefront-runner 2.4.6 → 2.4.7

package/apps/storefront/migrations-apps/0014_retire_candidate_ledger.sql

@@ -0,0 +1,12 @@
+-- The candidate preparation ledger has no writer or reader: candidate progress lives in the KV
+-- ReviewEnvironment index, and the release state in the tenant pipeline. Its tables are renamed
+-- aside, not dropped, so the rows survive until a backup is taken; rename back to restore. The
+-- indexes are dropped so their names are free (they are re-creatable from the rows).
+DROP INDEX IF EXISTS `idx_candidate_attempts_tenant`;
+DROP INDEX IF EXISTS `idx_candidate_attempts_candidate`;
+DROP INDEX IF EXISTS `uq_candidate_attempts_candidate_number`;
+ALTER TABLE `candidate_attempts` RENAME TO `retired_candidate_attempts_20261010`;
+DROP INDEX IF EXISTS `idx_candidates_tenant_status`;
+DROP INDEX IF EXISTS `uq_candidates_tenant_change`;
+DROP INDEX IF EXISTS `uq_candidates_tenant_repo_pr`;
+ALTER TABLE `candidates` RENAME TO `retired_candidates_20261010`;

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -564,94 +564,6 @@ export const newsletterSends = sqliteTable(
   (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.collection, t.digestId] }) }),
 );
 
-// --- Canonical publish-candidate identity -----------------------------------
-// ONE canonical candidate per `(tenant_id, repository, pr_number)` — the real
-// forge PR. Retries/rebuilds are NOT new candidates; they are child `attempts`
-// (below). This is the durable identity spine other units resolve against; the
-// KV `ReviewEnvironment` (`cust:*`) and aggregate/release models (`rel:*`) are
-// read projections that reference this row's `change_id`/`pr_number`.
-//
-// `id` is a SYNTHETIC surrogate (`cand_<uuid>`), deliberately DISTINCT from the
-// canonical key so foreign keys (attempts) never depend on the mutable natural
-// key. `change_id` is the REAL forge change id — the stable branch/build
-// identity (`candidate/<change_id>`) — preserved, never derived from `id`.
-// `tenant_id` is the isolation boundary, written from the resolved session,
-// NEVER a client body. The UNIQUE `(tenant_id, repository, pr_number)` is what
-// makes "one candidate per PR" a schema invariant (upsert-by-key, not
-// insert-then-dedupe); the UNIQUE `(tenant_id, change_id)` keeps the branch/
-// build identity unambiguous for resolve-by-changeId callers.
-export const candidates = sqliteTable(
-  "candidates",
-  {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id").notNull(),
-    // The `<tenant>-<tag>` forge repository the PR lives in.
-    repository: text("repository").notNull(),
-    // The forge PR number — the third leg of the canonical key.
-    prNumber: integer("pr_number").notNull(),
-    // The real forge change id — stable branch/build identity (`candidate/<change_id>`).
-    changeId: text("change_id").notNull(),
-    // Source branch, conventionally `candidate/<change_id>` (nullable convenience mirror).
-    branch: text("branch"),
-    title: text("title"),
-    author: text("author"),
-    // Canonical candidate lifecycle: open | preparing | ready | needs-attention | accepted | rejected | closed.
-    status: text("status").notNull().default("open"),
-    // The PR head/base shas as last reconciled (nullable until first read).
-    headSha: text("head_sha"),
-    baseSha: text("base_sha"),
-    createdAt: text("created_at").notNull(),
-    updatedAt: text("updated_at").notNull(),
-  },
-  (t) => ({
-    uqCandidatesCanonical: uniqueIndex("uq_candidates_tenant_repo_pr").on(
-      t.tenantId,
-      t.repository,
-      t.prNumber,
-    ),
-    uqCandidatesChange: uniqueIndex("uq_candidates_tenant_change").on(t.tenantId, t.changeId),
-    idxCandidatesTenantStatus: index("idx_candidates_tenant_status").on(t.tenantId, t.status),
-  }),
-);
-
-// One `attempt` = one build/check/rebase EXECUTION of a candidate. Attempts are
-// the child rows retries produce — they must NEVER queue as separate top-level
-// candidate rows. `candidate_id` references `candidates.id` in code only (no SQL
-// FK — repo convention, matches `webhook_deliveries.event_id` / `orders`).
-// `tenant_id` is denormalized for tenant-scoped reads/isolation without a join.
-// `attempt_number` is monotonic per candidate (1,2,3…) giving stable ordering;
-// UNIQUE `(candidate_id, attempt_number)` makes a double-assigned number a loud
-// failure rather than a silent duplicate. `kind`: build | check | rebase;
-// `status`: pending | running | passed | failed | cancelled (mirrors
-// `IntegrationRun`'s state vocabulary). `evidence` is a JSON EvidenceReport
-// snapshot; `detail` a human-legible terminal-state message.
-export const candidateAttempts = sqliteTable(
-  "candidate_attempts",
-  {
-    id: text("id").primaryKey(),
-    candidateId: text("candidate_id").notNull(),
-    tenantId: text("tenant_id").notNull(),
-    attemptNumber: integer("attempt_number").notNull(),
-    kind: text("kind").notNull(),
-    status: text("status").notNull().default("pending"),
-    // The candidate head sha this attempt executed against, or null if unknown.
-    headSha: text("head_sha"),
-    detail: text("detail"),
-    evidence: text("evidence"),
-    startedAt: text("started_at").notNull(),
-    // Null while pending/running; set on a terminal transition.
-    finishedAt: text("finished_at"),
-  },
-  (t) => ({
-    uqAttemptNumber: uniqueIndex("uq_candidate_attempts_candidate_number").on(
-      t.candidateId,
-      t.attemptNumber,
-    ),
-    idxAttemptsCandidate: index("idx_candidate_attempts_candidate").on(t.candidateId),
-    idxAttemptsTenant: index("idx_candidate_attempts_tenant").on(t.tenantId),
-  }),
-);
-
 // One active submit per tenant/change. This serializes identity authorization,
 // the Gitea mutation, and audit finalization so a verified callback cannot
 // become stale between its forge read and its KV writes. `expires_at` is

package/apps/storefront/test/pipeline/fake-preview-services.ts

@@ -27,7 +27,6 @@ import type {
   MembershipEntry,
   MergeCandidate,
   PreviewJobServices,
-  ReadModelTip,
 } from "../../src/lib/pipeline/preview-jobs";
 
 /** Files a fake build materializes. */
@@ -176,11 +175,6 @@ export function fakePreviewServices(state: DurableObjectState): PreviewJobServic
       return row?.sha ?? null;
     },
 
-    async readModelTip(): Promise<ReadModelTip | null> {
-      const rm = sql.exec<{ sha: string; membership: string; green: number }>(`SELECT * FROM fake_read_model`).toArray()[0];
-      return rm ? { sha: rm.sha, membership: JSON.parse(rm.membership), green: rm.green === 1 } : null;
-    },
-
     async materialize({ sha, resume }) {
       if (await fires("evict-before-build")) evict("before build");
       const moveTo = sql

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.6",
+  "version": "2.4.7",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/candidate-index.ts

@@ -147,8 +147,7 @@ export interface ReviewEnvironment {
    * seeds this projection BEFORE the async reconcile webhook ever fires, so a
    * dead/unregistered webhook shows as "queued since <submittedAt>, never
    * picked up" instead of no record at all). Additive + optional: every OTHER
-   * writer of this projection (`reconcileCandidate`, `acceptCandidateAtomic`,
-   * terminal cleanup) simply carries it forward unset/
+   * writer of this projection (`reconcileCandidate`, terminal cleanup) simply carries it forward unset/
    * untouched — only the submit-ack path ever sets it. Deliberately distinct
    * from `updatedAt`, which every writer bumps on any recompute for any reason.
    */