commandmate 0.16.0 → 0.17.0

package/dist/server/src/lib/db/migrations/v51-task-events.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Migration v51: task_events (Issue #1548, Phase 3-1).
+ *
+ * An append-only log of every attempt to move a task's status. v50 recorded
+ * where a task *is*; this records how it got there — which is what "how many
+ * times did a human have to intervene" and "how many re-instruction loops did
+ * this take" are computed from (Phase 4 Eval). Neither question is answerable
+ * from a status column that only ever holds the latest value.
+ *
+ * `to_status` is nullable on purpose: a rejected transition is written with
+ * `to_status = NULL`. An event the state machine refused is evidence that some
+ * caller believed a transition was possible when it was not, and silently
+ * dropping it would hide exactly the wiring bug worth finding.
+ *
+ * No CHECK constraint on `event`, unlike `tasks.status` in v50. The status
+ * vocabulary is written by many callers and read by queries that branch on it;
+ * events have a single writer (`applyTaskEvent`) whose input is a closed
+ * TypeScript union, so a CHECK here would only add a migration to the cost of
+ * adding an event without closing a hole the type system leaves open.
+ *
+ * No foreign key to `tasks` for the same reason v50's
+ * `last_verification_run_id` has none: this table is history, and history that
+ * disappears when its subject is deleted cannot be audited afterwards.
+ *
+ * Timestamps are epoch milliseconds (INTEGER), matching v44 onward.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v51_migrations = void 0;
+exports.v51_migrations = [
+    {
+        version: 51,
+        name: 'add-task-events',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS task_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          task_id TEXT NOT NULL,
+          event TEXT NOT NULL,
+          from_status TEXT NOT NULL,
+          to_status TEXT,
+          payload_json TEXT,
+          created_at INTEGER NOT NULL
+        );
+      `);
+            // (task_id, created_at) is the only read pattern: one task's history in
+            // order. id breaks ties, because same-millisecond events are ordinary —
+            // a rejected transition and its retry can land in the same tick.
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_task_events_task
+          ON task_events(task_id, created_at);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP TABLE IF EXISTS task_events;');
+        },
+    },
+];

package/dist/server/src/lib/db/task-events-db.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * task_events row I/O (Issue #1548, migration v51).
+ *
+ * `insertTaskEvent` is deliberately NOT re-exported from the `@/lib/db` barrel.
+ * The log is only meaningful if every row was produced by a real state-machine
+ * decision, so the sole writer is `applyTaskEvent`
+ * (`@/lib/tasks/task-transition-service`), which imports this module directly.
+ * A caller reaching for the barrel gets the reader and nothing else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.insertTaskEvent = insertTaskEvent;
+exports.listTaskEvents = listTaskEvents;
+function mapRow(row) {
+    return {
+        id: row.id,
+        taskId: row.task_id,
+        event: row.event,
+        fromStatus: row.from_status,
+        toStatus: row.to_status,
+        payload: row.payload_json === null ? null : JSON.parse(row.payload_json),
+        createdAt: new Date(row.created_at),
+    };
+}
+/** Append one event. See the module comment for why this is not barrel-exported. */
+function insertTaskEvent(db, input) {
+    // An empty payload is stored as NULL rather than '{}': "nothing was attached"
+    // and "an empty object was attached" are the same fact, and one of them makes
+    // the column readable at a glance.
+    const payloadJson = input.payload === undefined || Object.keys(input.payload).length === 0
+        ? null
+        : JSON.stringify(input.payload);
+    const info = db
+        .prepare(`
+      INSERT INTO task_events (task_id, event, from_status, to_status, payload_json, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `)
+        .run(input.taskId, input.event, input.fromStatus, input.toStatus, payloadJson, input.createdAt);
+    return Number(info.lastInsertRowid);
+}
+/**
+ * One task's history, oldest first.
+ *
+ * `id ASC` breaks ties rather than leaving same-millisecond rows in an arbitrary
+ * order — a rejected transition and the retry that followed it routinely share a
+ * timestamp, and reading them out of order inverts the story they tell.
+ */
+function listTaskEvents(db, taskId, limit = 200) {
+    const rows = db
+        .prepare(`
+      SELECT id, task_id, event, from_status, to_status, payload_json, created_at
+      FROM task_events
+      WHERE task_id = ?
+      ORDER BY created_at ASC, id ASC
+      LIMIT ?
+    `)
+        .all(taskId, limit);
+    return rows.map(mapRow);
+}

package/dist/server/src/lib/db/tasks-db.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Task database operations (Issue #1545, migration v50).
+ *
+ * A task row is the durable record of an execution contract: the goal that was
+ * sent, the paths the agent was allowed to touch, the gates that decide
+ * completion, and where the task got to. `contract_json` holds the *parsed
+ * snapshot* taken at send time, so editing the contract file afterwards cannot
+ * change what a running task agreed to.
+ *
+ * `updateTaskStatus` throws when the row does not exist. A silent no-op would
+ * let a caller believe it recorded a transition it never recorded — the same
+ * failure `verification-db.ts` guards against.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = void 0;
+exports.isTerminalTaskStatus = isTerminalTaskStatus;
+exports.createTask = createTask;
+exports.getTask = getTask;
+exports.listTasks = listTasks;
+exports.updateTaskStatus = updateTaskStatus;
+exports.getActiveTask = getActiveTask;
+exports.getActiveTaskForInstance = getActiveTaskForInstance;
+const crypto_1 = require("crypto");
+/**
+ * Lifecycle of a task.
+ *
+ * The runtime tuple mirrors the `status` CHECK constraint in migration v50 and
+ * is what callers validate untrusted input against, so a status cannot be
+ * accepted by an API route and then rejected by SQLite.
+ *
+ * `not_started` is distinct from `failed`: the work was never produced, so
+ * nothing was judged. `failed` means a verdict was reached, or that no verdict
+ * could be reached at all — either way the task did not pass.
+ */
+exports.TASK_STATUSES = [
+    'pending',
+    'running',
+    'waiting_input',
+    'verifying',
+    'succeeded',
+    'failed',
+    'not_started',
+    'cancelled',
+];
+/** Statuses a task can no longer move out of. */
+exports.TERMINAL_TASK_STATUSES = [
+    'succeeded',
+    'failed',
+    'not_started',
+    'cancelled',
+];
+/**
+ * Statuses that mean "this task is the one a verification run belongs to".
+ *
+ * `pending` is excluded on purpose: nothing has been sent, so there is no work
+ * a run could be judging.
+ */
+exports.ACTIVE_TASK_STATUSES = [
+    'running',
+    'waiting_input',
+    'verifying',
+];
+function isTerminalTaskStatus(status) {
+    return exports.TERMINAL_TASK_STATUSES.includes(status);
+}
+const TASK_COLUMNS = `
+  id, worktree_id, cli_tool_id, instance_id, title, goal, contract_path, contract_json,
+  status, last_verification_run_id, created_at, updated_at, started_at, finished_at
+`;
+function mapTaskRow(row) {
+    return {
+        id: row.id,
+        worktreeId: row.worktree_id,
+        cliToolId: row.cli_tool_id,
+        instanceId: row.instance_id,
+        title: row.title,
+        goal: row.goal,
+        contractPath: row.contract_path,
+        contract: JSON.parse(row.contract_json),
+        status: row.status,
+        lastVerificationRunId: row.last_verification_run_id,
+        createdAt: new Date(row.created_at),
+        updatedAt: new Date(row.updated_at),
+        startedAt: row.started_at === null ? null : new Date(row.started_at),
+        finishedAt: row.finished_at === null ? null : new Date(row.finished_at),
+    };
+}
+/** Insert a task, `pending` unless the caller says otherwise. */
+function createTask(db, input) {
+    const now = Date.now();
+    const id = (0, crypto_1.randomUUID)();
+    const status = input.status ?? 'pending';
+    db.prepare(`
+    INSERT INTO tasks (
+      id, worktree_id, cli_tool_id, instance_id, title, goal, contract_path, contract_json,
+      status, last_verification_run_id, created_at, updated_at, started_at, finished_at
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, NULL)
+  `).run(id, input.worktreeId, input.cliToolId, input.instanceId ?? null, input.contract.title, input.contract.goal, input.contractPath ?? null, JSON.stringify(input.contract), status, now, now, status === 'pending' ? null : now);
+    const task = getTask(db, id);
+    if (!task) {
+        throw new Error('Failed to persist task');
+    }
+    return task;
+}
+function getTask(db, taskId) {
+    const row = db
+        .prepare(`SELECT ${TASK_COLUMNS} FROM tasks WHERE id = ?`)
+        .get(taskId);
+    return row ? mapTaskRow(row) : null;
+}
+/**
+ * Tasks for a worktree, newest first.
+ *
+ * `rowid DESC` breaks ties, not `id DESC`: ids are random UUIDs, so comparing
+ * them orders same-millisecond rows arbitrarily. rowid is insertion order, which
+ * is what "newest" means when two tasks share a timestamp.
+ */
+function listTasks(db, worktreeId, limit = 20) {
+    const rows = db
+        .prepare(`
+      SELECT ${TASK_COLUMNS} FROM tasks
+      WHERE worktree_id = ?
+      ORDER BY created_at DESC, rowid DESC
+      LIMIT ?
+    `)
+        .all(worktreeId, limit);
+    return rows.map(mapTaskRow);
+}
+/**
+ * Move a task to `status`, stamping the timestamps that status implies.
+ *
+ * `started_at` is written on the first transition out of `pending` and never
+ * overwritten — it records when the work began, not when it last changed state.
+ * `finished_at` is written for terminal statuses only.
+ *
+ * @throws Error when the task does not exist
+ */
+function updateTaskStatus(db, taskId, status, patch = {}) {
+    const now = Date.now();
+    const info = db
+        .prepare(`
+      UPDATE tasks
+      SET status = ?,
+          updated_at = ?,
+          started_at = CASE WHEN ? = 'pending' THEN started_at ELSE COALESCE(started_at, ?) END,
+          finished_at = CASE WHEN ? = 1 THEN ? ELSE finished_at END,
+          last_verification_run_id = COALESCE(?, last_verification_run_id)
+      WHERE id = ?
+    `)
+        .run(status, now, status, now, isTerminalTaskStatus(status) ? 1 : 0, now, patch.lastVerificationRunId ?? null, taskId);
+    if (info.changes === 0) {
+        throw new Error(`Task ${taskId} not found`);
+    }
+    return getTask(db, taskId);
+}
+/**
+ * The task a verification run for this worktree belongs to, or null.
+ *
+ * Filters are applied only when supplied. A verification run is worktree-scoped
+ * — the gates execute over the whole working tree and a worktree admits one run
+ * at a time — so the runner resolves without filters and takes the most recently
+ * updated active task.
+ */
+function getActiveTask(db, worktreeId, cliToolId, instanceId) {
+    const conditions = ['worktree_id = ?'];
+    const params = [worktreeId];
+    if (cliToolId !== undefined) {
+        conditions.push('cli_tool_id = ?');
+        params.push(cliToolId);
+    }
+    if (instanceId !== undefined) {
+        conditions.push('instance_id = ?');
+        params.push(instanceId);
+    }
+    const placeholders = exports.ACTIVE_TASK_STATUSES.map(() => '?').join(', ');
+    const row = db
+        .prepare(`
+      SELECT ${TASK_COLUMNS} FROM tasks
+      WHERE ${conditions.join(' AND ')} AND status IN (${placeholders})
+      ORDER BY updated_at DESC, created_at DESC, rowid DESC
+      LIMIT 1
+    `)
+        .get(...params, ...exports.ACTIVE_TASK_STATUSES);
+    return row ? mapTaskRow(row) : null;
+}
+/**
+ * The active task governing one agent instance, or null.
+ *
+ * Distinct from {@link getActiveTask} because the primary instance is recorded
+ * two different ways: `instance_id` is NULL when no `--instance` was given, and
+ * the tool id itself (`'claude'`) when `--instance claude` was. Both mean the
+ * primary instance, so both must match — `= ?` cannot express either, since
+ * `instance_id = NULL` is never true in SQL.
+ *
+ * Auto-Yes needs this precision: a contract sent to `codex-2` must not govern
+ * the auto-answering of `codex`, and taking the worktree's most recent active
+ * task would do exactly that.
+ *
+ * @param instanceId - Agent instance id; pass the tool id itself for the primary
+ */
+function getActiveTaskForInstance(db, worktreeId, cliToolId, instanceId) {
+    const isPrimary = instanceId === cliToolId;
+    const placeholders = exports.ACTIVE_TASK_STATUSES.map(() => '?').join(', ');
+    const row = db
+        .prepare(`
+      SELECT ${TASK_COLUMNS} FROM tasks
+      WHERE worktree_id = ?
+        AND cli_tool_id = ?
+        AND (instance_id = ? OR (instance_id IS NULL AND ?))
+        AND status IN (${placeholders})
+      ORDER BY updated_at DESC, created_at DESC, rowid DESC
+      LIMIT 1
+    `)
+        .get(worktreeId, cliToolId, instanceId, isPrimary ? 1 : 0, ...exports.ACTIVE_TASK_STATUSES);
+    return row ? mapTaskRow(row) : null;
+}

package/dist/server/src/lib/db/verification-db.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Verification run database operations (Issue #1542, migration v49).
+ *
+ * Persists the outcome of a verification gate run: one `verification_runs` row
+ * per attempt, one `verification_gate_results` row per command inside it.
+ *
+ * Both create* functions open a record in `running` state and both finish*
+ * functions close it. That split is deliberate: a run that crashes mid-flight
+ * leaves a `running` row behind, which is recoverable evidence, whereas a
+ * single write-on-completion would leave nothing at all.
+ *
+ * The finish* functions throw when the target row does not exist. A silent
+ * no-op would let a caller believe it recorded a verdict it never recorded —
+ * exactly the failure this table exists to make impossible.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.VERIFICATION_TRIGGERS = void 0;
+exports.createVerificationRun = createVerificationRun;
+exports.finishVerificationRun = finishVerificationRun;
+exports.createGateResult = createGateResult;
+exports.finishGateResult = finishGateResult;
+exports.getVerificationRun = getVerificationRun;
+exports.getRunningVerificationRun = getRunningVerificationRun;
+exports.listRunningVerificationRuns = listRunningVerificationRuns;
+exports.listVerificationRuns = listVerificationRuns;
+exports.listVerificationRunsForPeriod = listVerificationRunsForPeriod;
+/**
+ * What caused a verification run to start.
+ *
+ * The runtime tuple mirrors the `trigger` CHECK constraint in migration v49 and
+ * is the single source callers validate untrusted input against, so a new
+ * trigger cannot be accepted by an API route and then rejected by SQLite.
+ */
+exports.VERIFICATION_TRIGGERS = ['manual', 'wait', 'api', 'task'];
+const RUN_COLUMNS = `
+  id, worktree_id, instance_id, task_id, trigger, status, base_ref, started_at, finished_at
+`;
+const GATE_COLUMNS = `
+  id, run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at, finished_at
+`;
+function mapRunRow(row) {
+    return {
+        id: row.id,
+        worktreeId: row.worktree_id,
+        instanceId: row.instance_id,
+        taskId: row.task_id,
+        trigger: row.trigger,
+        status: row.status,
+        baseRef: row.base_ref,
+        startedAt: new Date(row.started_at),
+        finishedAt: row.finished_at === null ? null : new Date(row.finished_at),
+    };
+}
+function mapGateRow(row) {
+    return {
+        id: row.id,
+        runId: row.run_id,
+        gateId: row.gate_id,
+        command: row.command,
+        status: row.status,
+        exitCode: row.exit_code,
+        durationMs: row.duration_ms,
+        logTail: row.log_tail,
+        startedAt: new Date(row.started_at),
+        finishedAt: row.finished_at === null ? null : new Date(row.finished_at),
+    };
+}
+/** Open a run in `running` state. */
+function createVerificationRun(db, input) {
+    const now = Date.now();
+    const info = db
+        .prepare(`
+      INSERT INTO verification_runs (
+        worktree_id, instance_id, task_id, trigger, status, base_ref, started_at, finished_at
+      )
+      VALUES (?, ?, ?, ?, 'running', ?, ?, NULL)
+    `)
+        .run(input.worktreeId, input.instanceId ?? null, input.taskId ?? null, input.trigger, input.baseRef ?? null, now);
+    const row = db
+        .prepare(`SELECT ${RUN_COLUMNS} FROM verification_runs WHERE id = ?`)
+        .get(Number(info.lastInsertRowid));
+    if (!row) {
+        throw new Error('Failed to persist verification run');
+    }
+    return mapRunRow(row);
+}
+/** Close a run with its final verdict, stamping `finished_at`. */
+function finishVerificationRun(db, runId, status) {
+    const info = db
+        .prepare('UPDATE verification_runs SET status = ?, finished_at = ? WHERE id = ?')
+        .run(status, Date.now(), runId);
+    if (info.changes === 0) {
+        throw new Error(`Verification run ${runId} not found`);
+    }
+}
+/** Open a gate result under an existing run, in `running` state. */
+function createGateResult(db, runId, input) {
+    const now = Date.now();
+    const info = db
+        .prepare(`
+      INSERT INTO verification_gate_results (
+        run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at, finished_at
+      )
+      VALUES (?, ?, ?, 'running', NULL, NULL, NULL, ?, NULL)
+    `)
+        .run(runId, input.gateId, input.command, now);
+    const row = db
+        .prepare(`SELECT ${GATE_COLUMNS} FROM verification_gate_results WHERE id = ?`)
+        .get(Number(info.lastInsertRowid));
+    if (!row) {
+        throw new Error('Failed to persist verification gate result');
+    }
+    return mapGateRow(row);
+}
+/** Close a gate result with its outcome, stamping `finished_at`. */
+function finishGateResult(db, gateResultId, patch) {
+    const info = db
+        .prepare(`
+      UPDATE verification_gate_results
+      SET status = ?, exit_code = ?, duration_ms = ?, log_tail = ?, finished_at = ?
+      WHERE id = ?
+    `)
+        .run(patch.status, patch.exitCode ?? null, patch.durationMs ?? null, patch.logTail ?? null, Date.now(), gateResultId);
+    if (info.changes === 0) {
+        throw new Error(`Verification gate result ${gateResultId} not found`);
+    }
+}
+/** Fetch a run with its gate results, or null when the run does not exist. */
+function getVerificationRun(db, runId) {
+    const runRow = db
+        .prepare(`SELECT ${RUN_COLUMNS} FROM verification_runs WHERE id = ?`)
+        .get(runId);
+    if (!runRow) {
+        return null;
+    }
+    const gateRows = db
+        .prepare(`
+      SELECT ${GATE_COLUMNS} FROM verification_gate_results
+      WHERE run_id = ?
+      ORDER BY started_at ASC, id ASC
+    `)
+        .all(runId);
+    return { ...mapRunRow(runRow), gates: gateRows.map(mapGateRow) };
+}
+/**
+ * The open run for a worktree, or null when none is in flight.
+ *
+ * A worktree admits one run at a time: two runs sharing a working tree would
+ * see each other's build output and their exit codes would describe neither.
+ * `id DESC` is a safety net — the invariant says there is at most one row, and
+ * if a bug ever breaks it the newest is the one a caller means.
+ */
+function getRunningVerificationRun(db, worktreeId) {
+    const row = db
+        .prepare(`
+      SELECT ${RUN_COLUMNS} FROM verification_runs
+      WHERE worktree_id = ? AND status = 'running'
+      ORDER BY id DESC
+      LIMIT 1
+    `)
+        .get(worktreeId);
+    return row ? mapRunRow(row) : null;
+}
+/**
+ * Every run still marked `running`, across all worktrees, oldest first.
+ *
+ * Used by startup reconciliation: after a restart no run is actually in flight,
+ * so every row this returns is an orphan whose verdict was lost.
+ */
+function listRunningVerificationRuns(db) {
+    const rows = db
+        .prepare(`
+      SELECT ${RUN_COLUMNS} FROM verification_runs
+      WHERE status = 'running'
+      ORDER BY id ASC
+    `)
+        .all();
+    return rows.map(mapRunRow);
+}
+/**
+ * Most recent runs for a worktree, newest first.
+ *
+ * `id DESC` breaks ties: runs started within the same millisecond are common
+ * enough that without it the "newest first" contract would be unordered.
+ */
+function listVerificationRuns(db, worktreeId, limit = 20) {
+    const rows = db
+        .prepare(`
+      SELECT ${RUN_COLUMNS} FROM verification_runs
+      WHERE worktree_id = ?
+      ORDER BY started_at DESC, id DESC
+      LIMIT ?
+    `)
+        .all(worktreeId, limit);
+    return rows.map(mapRunRow);
+}
+/** Default page size for {@link listVerificationRunsForPeriod}. */
+exports.DEFAULT_RUN_HISTORY_LIMIT = 50;
+/** Largest page {@link listVerificationRunsForPeriod} will return. */
+exports.MAX_RUN_HISTORY_LIMIT = 500;
+/** Longest window {@link listVerificationRunsForPeriod} will look back over. */
+exports.MAX_RUN_HISTORY_DAYS = 90;
+const MS_PER_DAY = 86_400_000;
+/** Clamp to an integer inside [min, max]; non-finite input falls back to `fallback`. */
+function clampInt(value, fallback, min, max) {
+    if (value === undefined || !Number.isFinite(value))
+        return fallback;
+    return Math.min(Math.max(Math.trunc(value), min), max);
+}
+/**
+ * Recent runs across worktrees, newest first, each with its gate verdicts but
+ * no log bodies (Issue #1593).
+ *
+ * `worktreeId` is optional because the advisor that consumes this (#1594) looks
+ * at a repository's trend, not one worktree's. Ordering follows the same
+ * `started_at DESC, id DESC` contract as {@link listVerificationRuns} so both
+ * feeds agree about what "newest" means.
+ *
+ * `days` and `limit` are clamped rather than rejected: this is a read-only feed
+ * and a caller asking for 10000 runs wants as many as it can have, not an
+ * exception. API routes validate before calling so a user typo still 400s.
+ */
+function listVerificationRunsForPeriod(db, opts = {}) {
+    const limit = clampInt(opts.limit, exports.DEFAULT_RUN_HISTORY_LIMIT, 1, exports.MAX_RUN_HISTORY_LIMIT);
+    const conditions = [];
+    const params = [];
+    if (opts.worktreeId !== undefined) {
+        conditions.push('worktree_id = ?');
+        params.push(opts.worktreeId);
+    }
+    if (opts.days !== undefined) {
+        const days = clampInt(opts.days, exports.MAX_RUN_HISTORY_DAYS, 1, exports.MAX_RUN_HISTORY_DAYS);
+        conditions.push('started_at >= ?');
+        params.push(Date.now() - days * MS_PER_DAY);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    const runRows = db
+        .prepare(`
+      SELECT ${RUN_COLUMNS} FROM verification_runs
+      ${where}
+      ORDER BY started_at DESC, id DESC
+      LIMIT ?
+    `)
+        .all(...params, limit);
+    if (runRows.length === 0)
+        return [];
+    const placeholders = runRows.map(() => '?').join(', ');
+    const gateRows = db
+        .prepare(`
+      SELECT run_id, gate_id, status, exit_code, duration_ms
+      FROM verification_gate_results
+      WHERE run_id IN (${placeholders})
+      ORDER BY started_at ASC, id ASC
+    `)
+        .all(...runRows.map((row) => row.id));
+    const byRun = new Map();
+    for (const row of gateRows) {
+        const summary = {
+            gateId: row.gate_id,
+            status: row.status,
+            exitCode: row.exit_code,
+            durationMs: row.duration_ms,
+        };
+        const bucket = byRun.get(row.run_id);
+        if (bucket)
+            bucket.push(summary);
+        else
+            byRun.set(row.run_id, [summary]);
+    }
+    return runRows.map((row) => ({ ...mapRunRow(row), gates: byRun.get(row.id) ?? [] }));
+}