kiokuko-dsh 0.1.0

package/migrations/017_enno_advisory_protocol_v2.sql

@@ -0,0 +1,101 @@
+-- Forward-only protocol eligibility: add the verify_prepare operation receipt
+-- value and require SQLite integer storage type (not merely column affinity)
+-- for the advisory revision/rank/version/degraded columns. Migration 016 is
+-- left byte-identical; valid rows are preserved atomically.
+
+ALTER TABLE enno_operation_receipts RENAME TO enno_operation_receipts_v16;
+
+CREATE TABLE enno_operation_receipts (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    operation TEXT NOT NULL CHECK (operation IN (
+        'ideal_submit', 'advice_submit', 'plan_submit', 'answer', 'work_report',
+        'finish', 'meditation_submit', 'verify_prepare'
+    )),
+    idempotency_key TEXT NOT NULL CHECK (length(idempotency_key) BETWEEN 1 AND 256),
+    request_digest TEXT NOT NULL CHECK (
+        length(request_digest) = 64 AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed')),
+    response_json TEXT,
+    created_at TEXT NOT NULL,
+    finished_at TEXT,
+    CHECK (
+        (state = 'started' AND response_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(response_json) = 'text' AND finished_at IS NOT NULL)
+    ),
+    PRIMARY KEY (run_id, operation, idempotency_key)
+);
+
+INSERT INTO enno_operation_receipts (
+    run_id, operation, idempotency_key, request_digest, state,
+    response_json, created_at, finished_at
+)
+SELECT run_id, operation, idempotency_key, request_digest, state,
+       response_json, created_at, finished_at
+FROM enno_operation_receipts_v16;
+
+DROP TABLE enno_operation_receipts_v16;
+
+CREATE TABLE enno_advisory_rounds_new (
+    round_id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    contract_revision INTEGER NOT NULL CHECK (
+        typeof(contract_revision) = 'integer' AND contract_revision >= 1
+    ),
+    mutation_revision INTEGER NOT NULL CHECK (
+        typeof(mutation_revision) = 'integer' AND mutation_revision >= 0
+    ),
+    phase TEXT NOT NULL CHECK (phase IN ('ideal', 'planning', 'final_review')),
+    input_digest TEXT NOT NULL CHECK (
+        length(input_digest) = 64 AND input_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    policy_version INTEGER NOT NULL CHECK (
+        typeof(policy_version) = 'integer' AND policy_version = 1
+    ),
+    source TEXT NOT NULL CHECK (source = 'host_reported'),
+    state TEXT NOT NULL CHECK (state IN ('advice_submitted', 'aggregated', 'consumed')),
+    degraded INTEGER NOT NULL CHECK (typeof(degraded) = 'integer' AND degraded IN (0, 1)),
+    aggregate_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE (run_id, contract_revision, mutation_revision, phase, input_digest)
+);
+
+INSERT INTO enno_advisory_rounds_new (
+    round_id, run_id, contract_revision, mutation_revision, phase, input_digest,
+    policy_version, source, state, degraded, aggregate_json, created_at, updated_at
+)
+SELECT round_id, run_id, contract_revision, mutation_revision, phase, input_digest,
+       policy_version, source, state, degraded, aggregate_json, created_at, updated_at
+FROM enno_advisory_rounds;
+
+CREATE TABLE enno_advisory_contributions_new (
+    round_id TEXT NOT NULL REFERENCES enno_advisory_rounds_new(round_id) ON DELETE CASCADE,
+    slot_id TEXT NOT NULL CHECK (length(slot_id) BETWEEN 1 AND 100),
+    slot_rank INTEGER NOT NULL CHECK (
+        typeof(slot_rank) = 'integer' AND slot_rank BETWEEN 0 AND 2
+    ),
+    outcome TEXT NOT NULL CHECK (outcome IN ('completed', 'failed', 'timeout', 'unavailable')),
+    contribution_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (round_id, slot_id),
+    UNIQUE (round_id, slot_rank)
+);
+
+INSERT INTO enno_advisory_contributions_new (
+    round_id, slot_id, slot_rank, outcome, contribution_json, created_at
+)
+SELECT round_id, slot_id, slot_rank, outcome, contribution_json, created_at
+FROM enno_advisory_contributions;
+
+DROP TABLE enno_advisory_contributions;
+DROP TABLE enno_advisory_rounds;
+
+ALTER TABLE enno_advisory_rounds_new RENAME TO enno_advisory_rounds;
+ALTER TABLE enno_advisory_contributions_new RENAME TO enno_advisory_contributions;
+
+CREATE INDEX idx_enno_advisory_rounds_current
+ON enno_advisory_rounds(run_id, contract_revision, mutation_revision, phase, state);
+
+CREATE INDEX idx_enno_advisory_contributions_round
+ON enno_advisory_contributions(round_id, slot_rank);

package/migrations/018_enno_repository_routing.sql

@@ -0,0 +1,5 @@
+-- A local process owned by the same OS user and operating in the canonical
+-- repository is trusted to resume the repository's single active Enno run.
+-- Client sessions are routing metadata, not immutable authorization owners.
+
+DROP TRIGGER IF EXISTS enno_client_binding_update_guard;

package/migrations/019_enno_execution_integrity.sql

@@ -0,0 +1,149 @@
+-- Enno continuation, execution ownership, crash recovery, and repository-bound
+-- verifier evidence. Existing v0.2.x rows remain readable; legacy evidence has
+-- NULL repository digests and is never treated as repository-state-bound.
+
+ALTER TABLE enno_contracts
+ADD COLUMN route_epoch INTEGER NOT NULL DEFAULT 0
+CHECK (typeof(route_epoch) = 'integer' AND route_epoch >= 0);
+
+CREATE TABLE enno_resume_tokens (
+    token_hash TEXT PRIMARY KEY CHECK (
+        length(token_hash) = 64 AND token_hash NOT GLOB '*[^0-9a-f]*'
+    ),
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    repository_root TEXT NOT NULL,
+    route_epoch INTEGER NOT NULL CHECK (typeof(route_epoch) = 'integer' AND route_epoch >= 0),
+    client_kind TEXT NOT NULL CHECK (client_kind IN ('codex', 'claude', 'opencode')),
+    client_session_id TEXT NOT NULL CHECK (length(client_session_id) BETWEEN 1 AND 256),
+    expires_at TEXT NOT NULL,
+    created_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_enno_resume_tokens_run_epoch
+ON enno_resume_tokens(run_id, route_epoch, expires_at);
+
+CREATE TABLE enno_execution_leases (
+    run_id TEXT PRIMARY KEY REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    contract_revision INTEGER NOT NULL CHECK (typeof(contract_revision) = 'integer' AND contract_revision >= 1),
+    mutation_revision INTEGER NOT NULL CHECK (typeof(mutation_revision) = 'integer' AND mutation_revision >= 0),
+    work_unit_id TEXT NOT NULL CHECK (length(work_unit_id) BETWEEN 1 AND 256),
+    route_epoch INTEGER NOT NULL CHECK (typeof(route_epoch) = 'integer' AND route_epoch >= 0),
+    owner_client_kind TEXT NOT NULL CHECK (owner_client_kind IN ('codex', 'claude', 'opencode')),
+    owner_session_id TEXT NOT NULL CHECK (length(owner_session_id) BETWEEN 1 AND 256),
+    lease_token_hash TEXT NOT NULL UNIQUE CHECK (
+        length(lease_token_hash) = 64 AND lease_token_hash NOT GLOB '*[^0-9a-f]*'
+    ),
+    lease_expires_at TEXT NOT NULL,
+    heartbeat_at TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    FOREIGN KEY (run_id, contract_revision, work_unit_id)
+        REFERENCES enno_work_units(run_id, contract_revision, work_unit_id)
+);
+
+ALTER TABLE enno_operation_receipts RENAME TO enno_operation_receipts_v18;
+
+CREATE TABLE enno_operation_receipts (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    operation TEXT NOT NULL CHECK (operation IN (
+        'ideal_submit', 'advice_submit', 'plan_submit', 'answer', 'work_report',
+        'finish', 'meditation_submit', 'verify_prepare'
+    )),
+    idempotency_key TEXT NOT NULL CHECK (length(idempotency_key) BETWEEN 1 AND 256),
+    request_digest TEXT NOT NULL CHECK (
+        length(request_digest) = 64 AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed', 'failed', 'abandoned')),
+    response_json TEXT,
+    owner_nonce TEXT,
+    lease_expires_at TEXT,
+    heartbeat_at TEXT,
+    failure_code TEXT,
+    created_at TEXT NOT NULL,
+    finished_at TEXT,
+    CHECK (
+        (state = 'started' AND response_json IS NULL AND finished_at IS NULL
+          AND typeof(owner_nonce) = 'text' AND typeof(lease_expires_at) = 'text' AND typeof(heartbeat_at) = 'text')
+        OR (state = 'completed' AND typeof(response_json) = 'text' AND finished_at IS NOT NULL)
+        OR (state IN ('failed', 'abandoned') AND response_json IS NULL AND finished_at IS NOT NULL
+          AND typeof(failure_code) = 'text')
+    ),
+    PRIMARY KEY (run_id, operation, idempotency_key)
+);
+
+INSERT INTO enno_operation_receipts (
+    run_id, operation, idempotency_key, request_digest, state, response_json,
+    owner_nonce, lease_expires_at, heartbeat_at, failure_code, created_at, finished_at
+)
+SELECT run_id, operation, idempotency_key, request_digest, state, response_json,
+       CASE WHEN state = 'started' THEN 'legacy-owner-' || idempotency_key ELSE NULL END,
+       CASE WHEN state = 'started' THEN created_at ELSE NULL END,
+       CASE WHEN state = 'started' THEN created_at ELSE NULL END,
+       NULL, created_at, finished_at
+FROM enno_operation_receipts_v18;
+
+DROP TABLE enno_operation_receipts_v18;
+
+ALTER TABLE enno_verifier_runs RENAME TO enno_verifier_runs_v18;
+
+CREATE TABLE enno_verifier_runs (
+    verifier_run_id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    work_unit_id TEXT,
+    contract_revision INTEGER NOT NULL CHECK (contract_revision >= 1),
+    mutation_revision INTEGER NOT NULL CHECK (mutation_revision >= 0),
+    verifier_id TEXT NOT NULL CHECK (length(verifier_id) BETWEEN 1 AND 256),
+    verifier_json TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('started', 'passed', 'failed', 'timeout', 'spawn_failed', 'abandoned')),
+    exit_code INTEGER,
+    signal TEXT,
+    duration_ms INTEGER,
+    stdout_preview TEXT,
+    stderr_preview TEXT,
+    stdout_digest TEXT,
+    stderr_digest TEXT,
+    owner_nonce TEXT,
+    lease_expires_at TEXT,
+    heartbeat_at TEXT,
+    failure_code TEXT,
+    repository_state_policy_version INTEGER,
+    pre_repository_digest TEXT,
+    post_repository_digest TEXT,
+    verifier_spec_digest TEXT,
+    changed_during_verification INTEGER CHECK (changed_during_verification IS NULL OR changed_during_verification IN (0, 1)),
+    started_at TEXT NOT NULL,
+    finished_at TEXT,
+    FOREIGN KEY (run_id, contract_revision, work_unit_id)
+        REFERENCES enno_work_units(run_id, contract_revision, work_unit_id),
+    CHECK (
+        (status = 'started' AND finished_at IS NULL AND duration_ms IS NULL
+          AND typeof(owner_nonce) = 'text' AND typeof(lease_expires_at) = 'text' AND typeof(heartbeat_at) = 'text')
+        OR (status = 'abandoned' AND finished_at IS NOT NULL AND typeof(failure_code) = 'text')
+        OR (status NOT IN ('started', 'abandoned') AND finished_at IS NOT NULL AND duration_ms IS NOT NULL AND duration_ms >= 0)
+    )
+);
+
+INSERT INTO enno_verifier_runs (
+    verifier_run_id, run_id, work_unit_id, contract_revision, mutation_revision,
+    verifier_id, verifier_json, status, exit_code, signal, duration_ms,
+    stdout_preview, stderr_preview, stdout_digest, stderr_digest,
+    owner_nonce, lease_expires_at, heartbeat_at, failure_code,
+    repository_state_policy_version, pre_repository_digest, post_repository_digest,
+    verifier_spec_digest, changed_during_verification, started_at, finished_at
+)
+SELECT verifier_run_id, run_id, work_unit_id, contract_revision, mutation_revision,
+       verifier_id, verifier_json, status, exit_code, signal, duration_ms,
+       stdout_preview, stderr_preview, stdout_digest, stderr_digest,
+       CASE WHEN status = 'started' THEN 'legacy-owner-' || verifier_run_id ELSE NULL END,
+       CASE WHEN status = 'started' THEN started_at ELSE NULL END,
+       CASE WHEN status = 'started' THEN started_at ELSE NULL END,
+       NULL, NULL, NULL, NULL, NULL, NULL, started_at, finished_at
+FROM enno_verifier_runs_v18;
+
+DROP TABLE enno_verifier_runs_v18;
+
+CREATE INDEX idx_enno_verifier_runs_freshness
+ON enno_verifier_runs(run_id, contract_revision, mutation_revision, status, finished_at DESC);
+
+CREATE INDEX idx_enno_verifier_runs_lease
+ON enno_verifier_runs(run_id, status, lease_expires_at);

package/migrations/020_cjk_fts.sql

@@ -0,0 +1,80 @@
+-- Keep word and substring semantics in separate external-content indexes. The
+-- application-owned content table contains only each entry's current revision.
+DROP TABLE entries_fts;
+DROP TABLE entries_trigram;
+
+CREATE TABLE entry_search_documents (
+    entry_rowid INTEGER PRIMARY KEY CHECK (entry_rowid > 0),
+    entry_id TEXT NOT NULL UNIQUE REFERENCES entries(id) ON DELETE CASCADE,
+    title TEXT NOT NULL,
+    body TEXT NOT NULL,
+    summary TEXT NOT NULL,
+    tags_text TEXT NOT NULL
+);
+
+CREATE VIRTUAL TABLE entries_fts USING fts5(
+    title,
+    body,
+    summary,
+    tags_text,
+    content='entry_search_documents',
+    content_rowid='entry_rowid',
+    tokenize='unicode61 remove_diacritics 2'
+);
+
+CREATE VIRTUAL TABLE entries_trigram USING fts5(
+    title,
+    body,
+    summary,
+    tags_text,
+    content='entry_search_documents',
+    content_rowid='entry_rowid',
+    tokenize='trigram'
+);
+
+CREATE TRIGGER entry_search_documents_ai
+AFTER INSERT ON entry_search_documents
+BEGIN
+    INSERT INTO entries_fts(rowid, title, body, summary, tags_text)
+    VALUES (new.entry_rowid, new.title, new.body, new.summary, new.tags_text);
+    INSERT INTO entries_trigram(rowid, title, body, summary, tags_text)
+    VALUES (new.entry_rowid, new.title, new.body, new.summary, new.tags_text);
+END;
+
+CREATE TRIGGER entry_search_documents_ad
+AFTER DELETE ON entry_search_documents
+BEGIN
+    INSERT INTO entries_fts(entries_fts, rowid, title, body, summary, tags_text)
+    VALUES ('delete', old.entry_rowid, old.title, old.body, old.summary, old.tags_text);
+    INSERT INTO entries_trigram(entries_trigram, rowid, title, body, summary, tags_text)
+    VALUES ('delete', old.entry_rowid, old.title, old.body, old.summary, old.tags_text);
+END;
+
+CREATE TRIGGER entry_search_documents_au
+AFTER UPDATE ON entry_search_documents
+BEGIN
+    INSERT INTO entries_fts(entries_fts, rowid, title, body, summary, tags_text)
+    VALUES ('delete', old.entry_rowid, old.title, old.body, old.summary, old.tags_text);
+    INSERT INTO entries_trigram(entries_trigram, rowid, title, body, summary, tags_text)
+    VALUES ('delete', old.entry_rowid, old.title, old.body, old.summary, old.tags_text);
+    INSERT INTO entries_fts(rowid, title, body, summary, tags_text)
+    VALUES (new.entry_rowid, new.title, new.body, new.summary, new.tags_text);
+    INSERT INTO entries_trigram(rowid, title, body, summary, tags_text)
+    VALUES (new.entry_rowid, new.title, new.body, new.summary, new.tags_text);
+END;
+
+INSERT INTO entry_search_documents(entry_rowid, entry_id, title, body, summary, tags_text)
+SELECT e.rowid,
+       e.id,
+       r.title,
+       r.body,
+       COALESCE(r.summary, ''),
+       COALESCE((SELECT group_concat(tag, ' ')
+                   FROM entry_revision_tags
+                  WHERE entry_id = e.id AND revision = e.current_revision), '')
+  FROM entries AS e
+  JOIN entry_revisions AS r
+    ON r.entry_id = e.id AND r.revision = e.current_revision;
+
+INSERT INTO entries_fts(entries_fts, rank) VALUES ('integrity-check', 1);
+INSERT INTO entries_trigram(entries_trigram, rank) VALUES ('integrity-check', 1);

package/migrations/021_semantic_embeddings.sql

@@ -0,0 +1,122 @@
+CREATE TABLE embedding_profiles (
+    profile_id TEXT PRIMARY KEY
+        CHECK (length(profile_id) = 64 AND profile_id NOT GLOB '*[^0-9a-f]*'),
+    provider_kind TEXT NOT NULL
+        CHECK (provider_kind IN ('openai-compatible')),
+    endpoint_fingerprint TEXT NOT NULL
+        CHECK (length(endpoint_fingerprint) = 64
+           AND endpoint_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    model TEXT NOT NULL,
+    dimensions INTEGER NOT NULL CHECK (dimensions BETWEEN 2 AND 8192),
+    distance_metric TEXT NOT NULL CHECK (distance_metric = 'cosine'),
+    distance_ceiling REAL NOT NULL
+        CHECK (distance_ceiling > 0.0 AND distance_ceiling < 2.0),
+    document_template_version INTEGER NOT NULL
+        CHECK (document_template_version > 0),
+    query_template_version INTEGER NOT NULL
+        CHECK (query_template_version > 0),
+    created_at TEXT NOT NULL
+);
+
+CREATE TRIGGER embedding_profiles_immutable_update
+BEFORE UPDATE ON embedding_profiles
+BEGIN
+    SELECT RAISE(ABORT, 'embedding_profiles are immutable');
+END;
+
+CREATE TABLE embedding_runtime (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    active_profile_id TEXT REFERENCES embedding_profiles(profile_id),
+    generation INTEGER NOT NULL CHECK (generation > 0),
+    activated_at TEXT
+);
+
+INSERT INTO embedding_runtime (
+    singleton, active_profile_id, generation, activated_at
+) VALUES (1, NULL, 1, NULL);
+
+CREATE TABLE entry_embeddings (
+    entry_id TEXT NOT NULL,
+    profile_id TEXT NOT NULL
+        REFERENCES embedding_profiles(profile_id) ON DELETE CASCADE,
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    content_hash TEXT NOT NULL,
+    document_hash TEXT NOT NULL
+        CHECK (length(document_hash) = 64
+           AND document_hash NOT GLOB '*[^0-9a-f]*'),
+    dimensions INTEGER NOT NULL CHECK (dimensions BETWEEN 2 AND 8192),
+    embedding BLOB NOT NULL,
+    vector_hash TEXT NOT NULL
+        CHECK (length(vector_hash) = 64
+           AND vector_hash NOT GLOB '*[^0-9a-f]*'),
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (entry_id, profile_id),
+    FOREIGN KEY (entry_id, revision)
+        REFERENCES entry_revisions(entry_id, revision)
+        ON DELETE CASCADE,
+    CHECK (length(embedding) = dimensions * 4)
+);
+
+CREATE INDEX idx_entry_embeddings_profile_revision
+    ON entry_embeddings(profile_id, entry_id, revision);
+
+CREATE TABLE embedding_jobs (
+    entry_id TEXT NOT NULL,
+    profile_id TEXT NOT NULL
+        REFERENCES embedding_profiles(profile_id) ON DELETE CASCADE,
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    content_hash TEXT NOT NULL,
+    state TEXT NOT NULL CHECK (
+        state IN ('pending', 'leased', 'failed', 'blocked')
+    ),
+    attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+    available_at TEXT NOT NULL,
+    lease_id TEXT,
+    lease_expires_at TEXT,
+    error_code TEXT CHECK (
+        error_code IS NULL OR error_code IN (
+            'timeout',
+            'rate_limited',
+            'provider_unavailable',
+            'invalid_response',
+            'dimension_mismatch',
+            'secret_blocked',
+            'profile_changed',
+            'entry_changed'
+        )
+    ),
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (entry_id, profile_id),
+    FOREIGN KEY (entry_id, revision)
+        REFERENCES entry_revisions(entry_id, revision)
+        ON DELETE CASCADE,
+    CHECK (
+        (state = 'leased' AND lease_id IS NOT NULL AND lease_expires_at IS NOT NULL)
+        OR
+        (state <> 'leased' AND lease_id IS NULL AND lease_expires_at IS NULL)
+    )
+);
+
+CREATE INDEX idx_embedding_jobs_claim
+    ON embedding_jobs(profile_id, state, available_at, entry_id);
+
+CREATE TABLE query_embeddings (
+    profile_id TEXT NOT NULL
+        REFERENCES embedding_profiles(profile_id) ON DELETE CASCADE,
+    query_hash TEXT NOT NULL
+        CHECK (length(query_hash) = 64
+           AND query_hash NOT GLOB '*[^0-9a-f]*'),
+    dimensions INTEGER NOT NULL CHECK (dimensions BETWEEN 2 AND 8192),
+    embedding BLOB NOT NULL,
+    vector_hash TEXT NOT NULL
+        CHECK (length(vector_hash) = 64
+           AND vector_hash NOT GLOB '*[^0-9a-f]*'),
+    created_at TEXT NOT NULL,
+    last_used_at TEXT NOT NULL,
+    PRIMARY KEY (profile_id, query_hash),
+    CHECK (length(embedding) = dimensions * 4)
+);
+
+CREATE INDEX idx_query_embeddings_lru
+    ON query_embeddings(profile_id, last_used_at, query_hash);