headlesscode 1.2.2 → 1.3.0

package/src/rsi/curriculum.ts

@@ -1,27 +1,42 @@
 import * as fs from "node:fs/promises"
 import * as path from "node:path"
+import { readArchive, writeArchive } from "./archive.js"
 import type { CandidateRecord, CurriculumTask, RsiArchive } from "./types.js"
+import completionDiscipline from "../../fixtures/rsi-curriculum/completion-discipline.json"
+import regressionRecovery from "../../fixtures/rsi-curriculum/regression-recovery.json"
+import toolEfficiency from "../../fixtures/rsi-curriculum/tool-efficiency.json"
+import generalization from "../../fixtures/rsi-curriculum/generalization.json"
 
-const FAILURE_TASKS: Record<string, { capability: string; difficulty: CurriculumTask["difficulty"]; template: string }> = {
+interface CurriculumFixture {
+	id: string
+	description: string
+	command: string
+	capability: string
+	task: string
+}
+
+const FIXTURE_MANIFESTS = { "completion-discipline": completionDiscipline, "regression-recovery": regressionRecovery, "tool-efficiency": toolEfficiency, generalization }
+const FIXTURES: Record<string, CurriculumFixture> = Object.fromEntries(Object.entries(FIXTURE_MANIFESTS).map(([id, fixture]) => {
+	if (fixture.id !== id || typeof fixture.task !== "string" || !fixture.task || typeof fixture.capability !== "string" || !fixture.capability || typeof fixture.description !== "string" || !fixture.description) throw new Error(`curriculum fixture manifest ${id} is missing registered task metadata`)
+	return [id, { id, description: fixture.description, command: `node fixtures/rsi-curriculum/validate.mjs --fixture ${id}`, capability: fixture.capability, task: fixture.task }]
+}))
+
+const FAILURE_TASKS: Record<string, { difficulty: CurriculumTask["difficulty"]; fixtureId: string }> = {
 	"iteration-cap": {
-		capability: "completion-discipline",
 		difficulty: 3,
-		template: "Complete a bounded implementation task and prove it with a final verification command before the iteration budget expires.",
+		fixtureId: "completion-discipline",
 	},
 	"regression-failure": {
-		capability: "regression-recovery",
 		difficulty: 3,
-		template: "Repair a deliberately failing change while preserving the existing regression suite and report the verified result.",
+		fixtureId: "regression-recovery",
 	},
 	"timeout": {
-		capability: "tool-efficiency",
 		difficulty: 4,
-		template: "Solve a repository task under a strict command-time budget without repeating unproductive exploration.",
+		fixtureId: "tool-efficiency",
 	},
 	"evaluation-failure": {
-		capability: "generalization",
 		difficulty: 4,
-		template: "Make a focused repository improvement that passes the visible suite and an adjacent executable behavior check.",
+		fixtureId: "generalization",
 	},
 }
 
@@ -43,26 +58,130 @@ export function generateCurriculumProposals(archive: RsiArchive, now = new Date(
 	}
 	return [...grouped.entries()].flatMap(([failureClass, candidates]) => {
 		const definition = FAILURE_TASKS[failureClass] ?? FAILURE_TASKS["evaluation-failure"]
+		const fixture = FIXTURES[definition.fixtureId]!
+		const existing = archive.curriculumTasks.find((task) => task.id === `curriculum-${failureClass}` && task.fixtureId === fixture.id && task.task === fixture.task)
 		return [{
 			id: `curriculum-${failureClass}`,
-			task: definition.template,
+			task: fixture.task,
 			difficulty: definition.difficulty,
-			capability: definition.capability,
-			groundTruthCommand: "npm test",
+			capability: fixture.capability,
+			groundTruthCommand: fixture.command,
+			fixtureId: fixture.id,
+			fixtureDescription: fixture.description,
 			provenance: { sourceCandidateIds: candidates.map((candidate) => candidate.id), failureClass, generatedAt: now },
-			validated: false,
+			validated: existing?.validated ?? false,
+			...(existing?.validation ? { validation: existing.validation } : {}),
+			...(existing?.promotedAt ? { promotedAt: existing.promotedAt } : {}),
 		}]
 	})
 }
 
 export function validateCurriculumTask(task: CurriculumTask): boolean {
-	return task.task.trim() !== "" && task.groundTruthCommand.trim() !== "" && task.provenance.sourceCandidateIds.length > 0
+	if (!task || typeof task !== "object") return false
+	if (typeof task.fixtureId !== "string" || typeof task.task !== "string" || typeof task.capability !== "string" || typeof task.groundTruthCommand !== "string" || typeof task.fixtureDescription !== "string") return false
+	const provenance = task.provenance as unknown
+	if (!provenance || typeof provenance !== "object") return false
+	const candidateIds = (provenance as { sourceCandidateIds?: unknown }).sourceCandidateIds
+	if (!Array.isArray(candidateIds) || candidateIds.length === 0 || candidateIds.some((id) => typeof id !== "string" || id.length === 0)) return false
+	const fixture = FIXTURES[task.fixtureId]
+	return Boolean(fixture && task.task === fixture.task && task.capability === fixture.capability && task.groundTruthCommand === fixture.command && task.fixtureDescription === fixture.description)
+}
+
+export interface CurriculumReplayResult {
+	ok: boolean
+	exitCode: number | null
+	outputSha256?: string
+	failure?: string
+}
+
+export async function validateCurriculumProposals(
+	tasks: CurriculumTask[],
+	baseCommit: string,
+	runReplay: (task: CurriculumTask, attempt: 1 | 2, idempotencyKey: string) => Promise<CurriculumReplayResult>,
+	now = new Date().toISOString(),
+): Promise<CurriculumTask[]> {
+	return Promise.all(tasks.map(async (task) => {
+		const replays: NonNullable<CurriculumTask["validation"]>["replays"] = []
+		let reason = ""
+		if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i.test(baseCommit)) reason = "clean base commit is missing or malformed"
+		else if (!validateCurriculumTask(task)) reason = "proposal does not resolve to an exact registered fixture and command"
+		if (!reason) {
+			for (const attempt of [1, 2] as const) {
+				const idempotencyKey = `curriculum:${task.id}:replay:${attempt}`
+				try {
+					const result = await runReplay(task, attempt, idempotencyKey)
+					replays.push({
+						idempotencyKey,
+						ok: result.ok,
+						exitCode: result.exitCode,
+						...(result.outputSha256 ? { outputSha256: result.outputSha256 } : {}),
+						...(result.failure ? { failure: result.failure.slice(0, 1000) } : {}),
+					})
+					if (!result.ok || result.exitCode !== 0 || !/^[a-f0-9]{64}$/i.test(result.outputSha256 ?? "")) {
+						reason = result.failure ?? `fixture replay ${attempt} did not produce a successful output artifact`
+						break
+					}
+				} catch (error) {
+					reason = error instanceof Error ? error.message.slice(0, 1000) : String(error).slice(0, 1000)
+					break
+				}
+			}
+		}
+		const first = replays[0]
+		const second = replays[1]
+		const reproducible = Boolean(!reason && first?.ok && second?.ok && first.exitCode === second.exitCode && first.outputSha256 === second.outputSha256)
+		if (!reason && !reproducible) reason = "two successful clean replays did not produce the same output digest"
+		return {
+			...task,
+			validated: reproducible,
+			validation: { baseCommit, command: task.groundTruthCommand, validatedAt: now, replays, reproducible, reason: reason || "two clean OpenShell replays passed reference tests, rejected a known mutant, and had identical output digests" },
+		}
+	}))
+}
+
+export function promoteValidatedCurriculumTask(task: CurriculumTask, promotedAt = new Date().toISOString()): CurriculumTask {
+	const validation = task.validation
+	const replays = Array.isArray(validation?.replays) ? validation.replays : []
+	const digest = replays[0]?.outputSha256
+	const evidenceValid = validateCurriculumTask(task)
+		&& task.validated === true
+		&& validation?.reproducible === true
+		&& /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i.test(validation.baseCommit)
+		&& validation.command === task.groundTruthCommand
+		&& replays.length === 2
+		&& replays.every((replay, index) => replay.ok === true && replay.exitCode === 0 && replay.idempotencyKey === `curriculum:${task.id}:replay:${index + 1}` && /^[a-f0-9]{64}$/i.test(replay.outputSha256 ?? "") && replay.outputSha256 === digest)
+	if (!evidenceValid) throw new Error(`curriculum task ${task.id} cannot be promoted without valid reproducible fixture evidence`)
+	return { ...task, promotedAt }
+}
+
+export async function promoteArchivedCurriculumTask(archiveDir: string, taskId: string, promotedAt = new Date().toISOString()): Promise<CurriculumTask> {
+	const archive = await readArchive(archiveDir)
+	const task = archive.curriculumTasks.find((entry) => entry.id === taskId)
+	if (!task) throw new Error(`curriculum task ${taskId} was not found in the archive`)
+	const promoted = promoteValidatedCurriculumTask(task, promotedAt)
+	archive.curriculumTasks = archive.curriculumTasks.map((entry) => entry.id === taskId ? promoted : entry)
+	for (const run of [...archive.runs, ...archive.activeRuns]) run.curriculumTasks = (run.curriculumTasks ?? []).map((entry) => entry.id === taskId ? promoted : entry)
+	const reportPaths = [...new Set([...archive.runs, ...archive.activeRuns].flatMap((run) => run.curriculumTasks?.some((entry) => entry.id === taskId) ? run.reports : []))]
+	const backups = new Map<string, string>()
+	for (const reportPath of reportPaths) backups.set(reportPath, await fs.readFile(reportPath, "utf8"))
+	try {
+		for (const reportPath of reportPaths) await fs.writeFile(reportPath, `${backups.get(reportPath)}\nCurriculum task ${taskId} was explicitly promoted at ${promotedAt}.\n`, "utf8")
+		await writeArchive(archiveDir, archive)
+	} catch (error) {
+		const rollbackFailures: string[] = []
+		for (const [reportPath, content] of backups) {
+			try { await fs.writeFile(reportPath, content, "utf8") }
+			catch (rollbackError) { rollbackFailures.push(`${reportPath}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`) }
+		}
+		if (rollbackFailures.length) throw new Error(`promotion failed: ${error instanceof Error ? error.message : String(error)}; report rollback failed: ${rollbackFailures.join("; ")}`)
+		throw error
+	}
+	return promoted
 }
 
 export async function writeCurriculumProposals(tasks: CurriculumTask[], outputDir: string): Promise<string> {
 	await fs.mkdir(outputDir, { recursive: true })
-	const validated = tasks.map((task) => ({ ...task, validated: validateCurriculumTask(task) }))
 	const outputPath = path.join(outputDir, "proposals.json")
-	await fs.writeFile(outputPath, `${JSON.stringify(validated, null, 2)}\n`, "utf8")
+	await fs.writeFile(outputPath, `${JSON.stringify(tasks, null, 2)}\n`, "utf8")
 	return outputPath
 }

package/src/rsi/evaluator.ts

@@ -1,36 +1,16 @@
-import { exec as execCallback } from "node:child_process"
-import { promisify } from "node:util"
 import type { CommandRunner, EvaluationSummary, RsiConfig, TrialResult } from "./types.js"
 import { changedFiles, candidateCommits, gitOutput } from "./workspace.js"
 import { protectedPathViolations } from "./sandbox.js"
-
-const exec = promisify(execCallback)
-
-export const runCommand: CommandRunner = async (command, cwd, timeoutMs, env) => {
-	const started = Date.now()
-	try {
-		const result = await exec(command, { cwd, env, timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 })
-		return { ok: true, command, exitCode: 0, durationMs: Date.now() - started, stdout: result.stdout, stderr: result.stderr }
-	} catch (error) {
-		const failure = error as { code?: number | string; killed?: boolean; stdout?: string; stderr?: string }
-		return {
-			ok: false,
-			command,
-			exitCode: typeof failure.code === "number" ? failure.code : null,
-			durationMs: Date.now() - started,
-			stdout: failure.stdout ?? "",
-			stderr: failure.stderr ?? String(error),
-			timedOut: failure.killed === true,
-		}
-	}
-}
+import { createOpenShellCommandRunner } from "./openshell.js"
 
 export async function evaluateCandidate(
 	config: RsiConfig,
 	candidateRoot: string,
 	baseCommit: string,
-	runner: CommandRunner = runCommand,
+	runner?: CommandRunner,
 ): Promise<EvaluationSummary> {
+	if (config.hiddenEvalCommands.length > 0) throw new Error("RSI hidden evaluations require a supervisor-only evaluator service; refusing to run hidden commands in a candidate guest")
+	const isolatedRunner = runner ?? createOpenShellCommandRunner(config)
 	const files = await changedFiles(candidateRoot, baseCommit)
 	const commits = await candidateCommits(candidateRoot, baseCommit)
 	const complexity = await complexityMetrics(candidateRoot, baseCommit, files)
@@ -59,23 +39,12 @@ export async function evaluateCandidate(
 			failureClassification: "protected-path-violation",
 		}
 	}
-	const regression = await runner("npm test", candidateRoot, config.commandTimeoutMs)
+	const regression = await isolatedRunner(config.regressionCommand, candidateRoot, config.commandTimeoutMs)
 	const visible: TrialResult[] = []
 	for (const command of config.evalCommands) {
-		visible.push(await runner(command, candidateRoot, config.commandTimeoutMs))
+		visible.push(await isolatedRunner(command, candidateRoot, config.commandTimeoutMs))
 	}
 	const hidden: TrialResult[] = []
-	for (const command of config.hiddenEvalCommands) {
-		// Hidden commands belong to the supervisor checkout. They receive the
-		// candidate path explicitly so a candidate cannot replace the evaluator
-		// script or package metadata in the process that scores it.
-		hidden.push(
-			await runner(command, config.repoRoot, config.commandTimeoutMs, {
-				...process.env,
-				HEADLESSCODE_RSI_CANDIDATE_ROOT: candidateRoot,
-			}),
-		)
-	}
 	return {
 		regression,
 		visible,

package/src/rsi/fitness.ts

@@ -1,14 +1,16 @@
-import type { EvaluationSummary, Fitness, HardGates } from "./types.js"
+import type { EvaluationSummary, Fitness, HardGates, PairedComparison } from "./types.js"
 
 function rate(passed: number, total: number): number {
 	return total === 0 ? 1 : passed / total
 }
 
 export function hardGatesFor(summary: EvaluationSummary): HardGates {
+	const hasTaskEvaluation = summary.visible.length > 0 || summary.hidden.length > 0
 	return {
 		regressionPass: summary.regression.ok,
-		visibleEvalPass: summary.visible.every((trial) => trial.ok),
+		visibleEvalPass: hasTaskEvaluation && summary.visible.every((trial) => trial.ok),
 		hiddenEvalPass: summary.hidden.every((trial) => trial.ok),
+		adversarialPass: summary.adversarialPass !== false,
 		noProtectedPathViolation: !summary.protectedPathViolation,
 		completed: summary.completed,
 		noCrash: !summary.crashed,
@@ -45,9 +47,11 @@ export function computeFitness(summary: EvaluationSummary): Fitness {
 		complexityPenalty,
 	}
 	const components = { regression, visible: visibleRate, hidden: hiddenRate, efficiency, recovery }
-	const score = Math.round(
+	const unpenalizedScore = Math.round(
 		(regression * 45 + visibleRate * 25 + hiddenRate * 20 + efficiency * 5 + recovery * 5 - complexityPenalty * 5) * 100,
 	) / 100
+	const adversarialPenalty = Math.min(10, Math.max(0, summary.adversarialPenalty ?? 0))
+	const score = Math.max(0, Math.round((unpenalizedScore - adversarialPenalty) * 100) / 100)
 	const failedGate = Object.entries(hardGates).find(([, passed]) => !passed)?.[0]
 	return {
 		score: failedGate ? 0 : score,
@@ -55,10 +59,41 @@ export function computeFitness(summary: EvaluationSummary): Fitness {
 		metrics,
 		complexity,
 		hardGates,
-		reason: failedGate ? `hard gate failed: ${failedGate}` : "all hard gates passed",
+		reason: failedGate ? `hard gate failed: ${failedGate}` : adversarialPenalty > 0 ? `all hard gates passed; adversarial findings penalty ${adversarialPenalty}` : "all hard gates passed",
+		...(adversarialPenalty > 0 ? { adversarialPenalty } : {}),
 	}
 }
 
 export function compareFitness(left: Fitness | undefined, right: Fitness | undefined): number {
 	return (left?.score ?? 0) - (right?.score ?? 0)
 }
+
+export function comparePairedEvaluation(baseline: EvaluationSummary, candidate: EvaluationSummary): PairedComparison {
+	const baselineTrials = [baseline.regression, ...baseline.visible, ...baseline.hidden]
+	const candidateTrials = [candidate.regression, ...candidate.visible, ...candidate.hidden]
+	const baselinePasses = baselineTrials.filter((trial) => trial.ok).length
+	const candidatePasses = candidateTrials.filter((trial) => trial.ok).length
+	const baselineDurationMs = baselineTrials.reduce((total, trial) => total + trial.durationMs, 0)
+	const candidateDurationMs = candidateTrials.reduce((total, trial) => total + trial.durationMs, 0)
+	const durationRatio = baselineDurationMs === 0 ? Number.POSITIVE_INFINITY : candidateDurationMs / baselineDurationMs
+	const comparable = baselineTrials.length === candidateTrials.length && baselineTrials.every((trial, index) => trial.command === candidateTrials[index]?.command)
+	const correctnessImproved = comparable && candidatePasses > baselinePasses
+	const efficiencyImproved = comparable && candidatePasses === baselinePasses && candidatePasses === candidateTrials.length && durationRatio <= 0.9
+	const improved = correctnessImproved || efficiencyImproved
+	return {
+		baselinePasses,
+		candidatePasses,
+		trialCount: Math.min(baselineTrials.length, candidateTrials.length),
+		baselineDurationMs,
+		candidateDurationMs,
+		durationRatio,
+		improved,
+		reason: !comparable
+			? "baseline and candidate did not run the same evaluation commands"
+			: correctnessImproved
+				? "candidate passed more paired evaluation trials"
+				: efficiencyImproved
+					? "candidate passed every paired trial and reduced total evaluation duration by at least 10%"
+					: "candidate did not meet the paired improvement threshold",
+	}
+}

package/src/rsi/index.ts

@@ -13,4 +13,5 @@ export * from "./workspace.js"
 export * from "./trajectory.js"
 export * from "./curriculum.js"
 export * from "./roles.js"
+export * from "./adversarial.js"
 export * from "./search.js"

package/src/rsi/migrations/001_postgres_fleet_queue.sql

@@ -0,0 +1,65 @@
+CREATE TABLE IF NOT EXISTS headlesscode_rsi_queue_policy (
+	queue_name text PRIMARY KEY,
+	max_in_flight integer NOT NULL CHECK (max_in_flight > 0),
+	lease_ms integer NOT NULL CHECK (lease_ms >= 1000),
+	max_attempts integer NOT NULL CHECK (max_attempts > 0),
+	class_capacity jsonb NOT NULL DEFAULT '{}'::jsonb,
+	key_capacity jsonb NOT NULL DEFAULT '{}'::jsonb,
+	updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE TABLE IF NOT EXISTS headlesscode_rsi_workers (
+	queue_name text NOT NULL REFERENCES headlesscode_rsi_queue_policy(queue_name),
+	worker_id text NOT NULL,
+	gateway_id text NOT NULL,
+	hostname text NOT NULL,
+	max_active integer NOT NULL CHECK (max_active > 0),
+	resource_classes jsonb NOT NULL DEFAULT '[]'::jsonb,
+	active boolean NOT NULL DEFAULT true,
+	registered_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+	heartbeat_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+	PRIMARY KEY(queue_name, worker_id)
+);
+
+CREATE TABLE IF NOT EXISTS headlesscode_rsi_artifacts (
+	sha256 char(64) PRIMARY KEY,
+	storage_id text NOT NULL,
+	object_key text NOT NULL,
+	backend text NOT NULL CHECK (backend IN ('s3', 'file')),
+	byte_length bigint NOT NULL CHECK (byte_length > 0),
+	created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+
+CREATE TABLE IF NOT EXISTS headlesscode_rsi_jobs (
+	job_id uuid PRIMARY KEY,
+	queue_name text NOT NULL REFERENCES headlesscode_rsi_queue_policy(queue_name),
+	idempotency_key text NOT NULL,
+	run_id text NOT NULL,
+	candidate_id text NOT NULL,
+	job_kind text NOT NULL CHECK (job_kind IN ('mutation', 'evaluation')),
+	resource_class text NOT NULL CHECK (resource_class IN ('LOCAL_GPU', 'CPU', 'REMOTE_API', 'TRAINING_GPU')),
+	concurrency_key text,
+	artifact_sha256 char(64) NOT NULL REFERENCES headlesscode_rsi_artifacts(sha256),
+	payload jsonb NOT NULL,
+	status text NOT NULL CHECK (status IN ('queued', 'leased', 'completed', 'failed', 'cancelled')),
+	attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+	max_attempts integer NOT NULL CHECK (max_attempts > 0),
+	available_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+	lease_owner text,
+	lease_token uuid,
+	lease_expires_at timestamptz,
+	result jsonb,
+	error text,
+	created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+	updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+	completed_at timestamptz,
+	CHECK ((status = 'leased') = (lease_owner IS NOT NULL AND lease_token IS NOT NULL AND lease_expires_at IS NOT NULL)),
+	UNIQUE(queue_name, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS headlesscode_rsi_jobs_claim_idx
+	ON headlesscode_rsi_jobs (queue_name, status, available_at, created_at)
+	WHERE status IN ('queued', 'leased');
+CREATE INDEX IF NOT EXISTS headlesscode_rsi_jobs_lease_idx
+	ON headlesscode_rsi_jobs (lease_expires_at)
+	WHERE status = 'leased';

package/src/rsi/migrations/002_external_artifacts_and_job_leases.sql

@@ -0,0 +1,39 @@
+DO $$
+DECLARE legacy_column record;
+DECLARE has_legacy_bytes boolean;
+BEGIN
+	FOR legacy_column IN
+		SELECT column_name FROM information_schema.columns
+		WHERE table_schema=current_schema() AND table_name='headlesscode_rsi_artifacts' AND data_type='bytea'
+	LOOP
+		EXECUTE format('SELECT EXISTS (SELECT 1 FROM headlesscode_rsi_artifacts WHERE %I IS NOT NULL)', legacy_column.column_name) INTO has_legacy_bytes;
+		IF has_legacy_bytes THEN
+			RAISE EXCEPTION 'RSI artifact column % still contains PostgreSQL blobs; upload legacy bytes to the configured shared object store and migrate their metadata first', legacy_column.column_name;
+		END IF;
+		EXECUTE format('ALTER TABLE headlesscode_rsi_artifacts DROP COLUMN %I', legacy_column.column_name);
+	END LOOP;
+END $$;
+
+ALTER TABLE headlesscode_rsi_artifacts ADD COLUMN IF NOT EXISTS storage_id text;
+ALTER TABLE headlesscode_rsi_artifacts ADD COLUMN IF NOT EXISTS object_key text;
+ALTER TABLE headlesscode_rsi_artifacts ADD COLUMN IF NOT EXISTS backend text;
+ALTER TABLE headlesscode_rsi_artifacts ADD COLUMN IF NOT EXISTS byte_length bigint;
+
+DO $$
+BEGIN
+	IF EXISTS (
+		SELECT 1 FROM headlesscode_rsi_artifacts
+		WHERE storage_id IS NULL OR object_key IS NULL OR backend IS NULL OR byte_length IS NULL
+	) THEN
+		RAISE EXCEPTION 'RSI artifacts need object-store references before migration 002; upload legacy artifact bytes to the configured shared object store and migrate their metadata first';
+	END IF;
+END $$;
+
+ALTER TABLE headlesscode_rsi_artifacts ALTER COLUMN storage_id SET NOT NULL;
+ALTER TABLE headlesscode_rsi_artifacts ALTER COLUMN object_key SET NOT NULL;
+ALTER TABLE headlesscode_rsi_artifacts ALTER COLUMN backend SET NOT NULL;
+ALTER TABLE headlesscode_rsi_artifacts ALTER COLUMN byte_length SET NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS headlesscode_rsi_artifacts_object_key_idx ON headlesscode_rsi_artifacts(object_key);
+
+ALTER TABLE headlesscode_rsi_jobs
+	ADD COLUMN IF NOT EXISTS lease_duration_ms integer NOT NULL DEFAULT 3600000 CHECK (lease_duration_ms >= 1000);

package/src/rsi/migrations/003_model_training_jobs.sql

@@ -0,0 +1,6 @@
+ALTER TABLE headlesscode_rsi_jobs
+	DROP CONSTRAINT IF EXISTS headlesscode_rsi_jobs_job_kind_check;
+
+ALTER TABLE headlesscode_rsi_jobs
+	ADD CONSTRAINT headlesscode_rsi_jobs_job_kind_check
+	CHECK (job_kind IN ('mutation', 'evaluation', 'training', 'model-evaluation'));