limn-review 0.1.123

package/dist/db/migrations/0044_workspaces.sql

@@ -0,0 +1,138 @@
+-- TEAMS BECOME WORKSPACES, AND A REPO GETS EXACTLY ONE. SQLite / local mode; Postgres twin:
+-- migrations-pg/0031_workspaces.sql. Migration 0045 then collapses the two bot tables onto the
+-- workspace key — read them together, they are one change in two steps:
+--
+--   0044  RE-HOME   repo grouping:  teams (m2m)  →  workspaces (1:N), + a Default per account
+--   0045  COLLAPSE  the bot object: repo_reviewers + account_reviewers → workspace_reviewers
+--
+-- WHY A WORKSPACE. `teams` was a many-to-many bag of repos alongside four scope sentinels
+-- ('all' / 'none' / 'teams' / a set), which made "which repos am I looking at" a five-branch
+-- question with three independent parsers. A workspace is the ONE scope: a repo belongs to
+-- EXACTLY ONE of them, so there is nothing to canonicalise and no "in no team" bucket.
+--
+-- WORKSPACE IDS ARE THE OLD TEAM IDS. Preserved deliberately: a URL, a bookmark, a persisted
+-- filter and (after the plugin's own 0020) a cache row all carry the number, and renumbering
+-- would silently repoint them at a different repo set.
+--
+-- ⚠ THE ONE THING THAT DIFFERS BETWEEN THE DIALECTS IS THE SEQUENCE. SQLite AUTOINCREMENT tracks
+-- max(rowid) ever seen, so an explicit-id INSERT advances it and the Default rows below get fresh
+-- ids for free. Postgres `serial` does NOT advance on an explicit-id INSERT, so the twin must
+-- setval() between the two inserts or the very next workspace collides with a preserved team id.
+--
+-- ── ON RE-RUNNING THIS FILE ─────────────────────────────────────────────────────────────────
+-- Every statement is IF NOT EXISTS / ON CONFLICT DO NOTHING down to the two DROPs, and the legacy
+-- source tables are STUBBED below, so the backfill is still a legal, empty statement on a database
+-- where they have already gone. That is the SQLite answer to the pg twin's `to_regclass` guard,
+-- which exists for the same reason: this file ends by dropping the tables its own backfill reads.
+
+-- THE LEGACY SOURCES, STUBBED — no-ops on every database this migration is meant for.
+CREATE TABLE IF NOT EXISTS `teams` (
+	`id` integer, `account_id` integer, `name` text, `created_at` integer
+);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `team_repos` (
+	`id` integer, `account_id` integer, `team_id` integer, `repo_id` integer, `created_at` integer
+);--> statement-breakpoint
+
+CREATE TABLE IF NOT EXISTS `workspaces` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`name` text NOT NULL,
+	`is_default` integer DEFAULT 0 NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `workspaces_account_name` ON `workspaces` (`account_id`,`name`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `workspaces_account_idx` ON `workspaces` (`account_id`);--> statement-breakpoint
+-- The parent key for the composite FKs on workspace_repos + workspace_reviewers. NOT a lookup
+-- index — `id` is already the PK — and both dialects require a unique index over the parent-key
+-- columns before such an FK is legal. Drop it and both composite FKs become unexpressible.
+CREATE UNIQUE INDEX IF NOT EXISTS `workspaces_id_account` ON `workspaces` (`id`,`account_id`);--> statement-breakpoint
+
+-- 1. One workspace per existing team, IDS PRESERVED.
+INSERT INTO `workspaces` (`id`, `account_id`, `name`, `is_default`, `created_at`)
+SELECT `id`, `account_id`, `name`, 0, `created_at` FROM `teams`
+ WHERE true
+ON CONFLICT (`id`) DO NOTHING;--> statement-breakpoint
+
+-- 2. A Default workspace for EVERY account, including accounts that never had a team.
+--    The three-level name CASE exists because `workspaces_account_name` is unique and a user may
+--    already own a team called "Default". The third form embeds the account id, so it cannot
+--    collide with the first two for the same account.
+INSERT INTO `workspaces` (`account_id`, `name`, `is_default`, `created_at`)
+SELECT a.`id`,
+       CASE
+         WHEN NOT EXISTS (SELECT 1 FROM `workspaces` w WHERE w.`account_id` = a.`id` AND w.`name` = 'Default')
+           THEN 'Default'
+         WHEN NOT EXISTS (SELECT 1 FROM `workspaces` w WHERE w.`account_id` = a.`id` AND w.`name` = 'Default workspace')
+           THEN 'Default workspace'
+         ELSE 'Default (workspace ' || a.`id` || ')'
+       END,
+       1, unixepoch()
+  FROM `accounts` a
+ WHERE NOT EXISTS (SELECT 1 FROM `workspaces` w WHERE w.`account_id` = a.`id` AND w.`is_default` = 1);--> statement-breakpoint
+
+-- 2b. ONE DEFAULT PER ACCOUNT, AS A DATABASE FACT. Created after the backfill so a hand-corrupted
+--     database fails on a statement whose meaning is obvious. This is what makes
+--     ensureDefaultWorkspace's "INSERT … ON CONFLICT DO NOTHING then re-SELECT" race-safe: it runs
+--     on effectively every request, and two concurrent calls for an account with no default would
+--     otherwise both SELECT nothing and both INSERT.
+CREATE UNIQUE INDEX IF NOT EXISTS `workspaces_one_default` ON `workspaces` (`account_id`) WHERE `is_default` = 1;--> statement-breakpoint
+
+-- EXACTLY ONE WORKSPACE PER REPO, AS A DATABASE FACT: the unique on (account_id, repo_id) is what
+-- makes assigning a repo elsewhere an UPSERT, i.e. a MOVE, with no code path able to produce a
+-- second membership row. `repo_id` alone would do (repos.id is a global PK) — account_id rides in
+-- the key so the isolation predicate and the conflict target are the same columns, the same
+-- discipline `repo_reviewers` used.
+--
+-- WHY A TABLE AND NOT A `repos.workspace_id` COLUMN. SQLite cannot ADD a CONSTRAINT to an existing
+-- table and cannot cheaply make an existing column NOT NULL; a NOT NULL FK column on `repos` means
+-- rebuilding `repos` (create-copy-drop-rename) under `foreign_keys=ON` with every child FK in the
+-- schema pointing at it mid-flight. A join table arrives fully constrained on day one.
+--
+-- TENANCY IS STRUCTURAL. `workspace_id` arrives in a REQUEST BODY, so a plain
+-- `REFERENCES workspaces(id)` would accept (account 2, workspace 10) where workspace 10 belongs to
+-- account 1 — both halves individually valid. The FK is COMPOSITE and NAMED, so Postgres quotes the
+-- name in the violation message and a grep for it finds a live constraint.
+CREATE TABLE IF NOT EXISTS `workspace_repos` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `workspace_repos_workspace_account_fk` FOREIGN KEY (`workspace_id`,`account_id`) REFERENCES `workspaces`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `workspace_repos_repo_account_fk` FOREIGN KEY (`repo_id`,`account_id`) REFERENCES `repos`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `workspace_repos_account_repo` ON `workspace_repos` (`account_id`,`repo_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `workspace_repos_account_workspace_idx` ON `workspace_repos` (`account_id`,`workspace_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `workspace_repos_repo_idx` ON `workspace_repos` (`repo_id`);--> statement-breakpoint
+
+-- 3. THE TIE-BREAK: a repo in 2+ teams keeps its EARLIEST assignment (lowest team_repos.id).
+--    Written as a correlated MIN() rather than DISTINCT ON, which SQLite does not have and which
+--    would therefore make the two dialects' files structurally different for no reason. The
+--    account predicate in the subquery is redundant (repos.id is a global PK, so repo_id already
+--    implies the account) and is spelled anyway so tenancy is visible in the statement.
+INSERT INTO `workspace_repos` (`account_id`, `workspace_id`, `repo_id`, `created_at`)
+SELECT tr.`account_id`, tr.`team_id`, tr.`repo_id`, tr.`created_at`
+  FROM `team_repos` tr
+ WHERE tr.`id` = (
+         SELECT MIN(tr2.`id`) FROM `team_repos` tr2
+          WHERE tr2.`repo_id` = tr.`repo_id` AND tr2.`account_id` = tr.`account_id`)
+ON CONFLICT (`account_id`, `repo_id`) DO NOTHING;--> statement-breakpoint
+
+-- 4. Every repo with no resulting row → that account's Default. Covers repos that were in no team
+--    at all AND (on a replay) anything step 3 could not place. A repo with NO membership row is
+--    invisible to every workspace-scoped read, which is why this statement exists and why the
+--    runtime keeps a repair (`ensureRepoMemberships`) on the same rule.
+INSERT INTO `workspace_repos` (`account_id`, `workspace_id`, `repo_id`, `created_at`)
+SELECT r.`account_id`, w.`id`, r.`id`, unixepoch()
+  FROM `repos` r
+  JOIN `workspaces` w ON w.`account_id` = r.`account_id` AND w.`is_default` = 1
+ WHERE NOT EXISTS (SELECT 1 FROM `workspace_repos` wr WHERE wr.`repo_id` = r.`id`)
+ON CONFLICT (`account_id`, `repo_id`) DO NOTHING;--> statement-breakpoint
+
+-- 5. Child first (team_repos FKs teams), then the parent. Leaving either behind would leave a
+--    second, differently-keyed answer to "which repos are grouped together" in every database —
+--    the exact failure `bot_review_classification` was dropped to avoid.
+DROP TABLE IF EXISTS `team_repos`;--> statement-breakpoint
+DROP TABLE IF EXISTS `teams`;

package/dist/db/migrations/0045_workspace_reviewers.sql

@@ -0,0 +1,180 @@
+-- THE BOT OBJECT COLLAPSES ONTO THE WORKSPACE KEY. SQLite / local mode; Postgres twin:
+-- migrations-pg/0032_workspace_reviewers.sql. Second half of the change 0044 starts:
+--
+--   0044  RE-HOME   repo grouping:  teams (m2m)  →  workspaces (1:N), + a Default per account
+--   0045  COLLAPSE  the bot object: repo_reviewers + account_reviewers → workspace_reviewers
+--
+-- `repo_reviewers` answered "is this login a bot" once per (account, repo). `account_reviewers`
+-- answered "who is it and what does it cost" once per (account, actor). With one workspace as the
+-- only scope, both questions have the same key, so both tables become one row per
+-- (account, workspace, actor) — and the fold that reads six repo rows into one metric answer
+-- disappears with them.
+--
+-- ⚠ WHAT MUST NOT BE LOST WITH THE MERGE: the two PROVENANCE FLAGS stay separate columns and are
+-- honoured INDEPENDENTLY. `source` owns automated/role/confidence/reasons; `identity_source` owns
+-- kind/label. Inside one row that separation is code discipline (a narrowed `set:` object) rather
+-- than a table boundary — a classification pass that respects only one of them either reverts a
+-- human's vendor correction or freezes auto-detection.
+--
+-- ⚠ `monthly_cents` IS NEVER IN ANY DERIVED UPDATE. It is the one column no classifier can
+-- regenerate. From here on the price is a per-WORKSPACE fact like every other attribute on this
+-- row: `setReviewerCost` writes ONE row, nothing fans out, nothing seeds a later row.
+-- NULL = no price set, 0 = "recorded as free". Nothing inherits; there is no chain behind a `??`.
+--
+-- ── THE FOLD RULE ────────────────────────────────────────────────────────────────────────────
+-- For each (account, workspace, actor) with at least one repo_reviewers row on a repo now in
+-- that workspace:
+--   automated  = TRUE if ANY contributing row is automated              (union — this half DOES
+--   role       = 'review' if ANY contributing row roles it 'review'      reproduce resolveJudgements
+--                else 'quality_check'                                    exactly, for READS)
+--   confidence = the highest confidence among the rows that carried the WINNING `automated` value
+--                (folding the max across all rows lets an automated=false row hand `high` to an
+--                 automated=true verdict it disagreed with)
+--   updated_at = MAX of the contributing rows
+--
+--   source     = 'manual' if ANY contributing row is manual, regardless of which side won.
+--                ⚠ THIS IS DELIBERATELY *NOT* THE READ-TIME UNION RULE, and the difference is the
+--                whole point. For reads, `manualHuman` is only consulted when nothing in scope
+--                calls the actor automated — so a manual "this is a human" on repo B losing to an
+--                auto-automated repo A is faithful. But `source` is not only a read input: it is
+--                the WRITE GATE in persist() and the flag behind the "Reset classification"
+--                affordance. Folding it to 'auto' would let the next classification pass silently
+--                overwrite a human's opinion, with no control offered to undo it and no trace in
+--                reasons_json. A visible, resettable pin the user can see is strictly better than
+--                a judgement that vanishes. (Same for a manual role='quality_check' that loses to
+--                an auto 'review': the role is wrong AND pinned — so the fold FLAGS it, below.)
+--                ELSE the source of the winning evidence — carried, not invented: the highest
+--                confidence row on the winning side of `automated`, ties broken by updated_at DESC
+--                then repo_id ASC so both dialects pick the same row. ⚠ NEVER the literal 'auto':
+--                that is the `identity_source` vocabulary. `ClassificationSource` is
+--                'manual'|'vendor_login'|'github_type'|'app_attribution'|'fingerprint'|
+--                'behavioral'|'ai_tiebreak' and an out-of-union value would never self-heal —
+--                persist() only revisits rows it derives, and the listing's lazy trigger is a
+--                MISSING row, which after this migration no actor has. `'fingerprint'` is the
+--                fallback if the subquery somehow finds nothing (it matches persistHumanJudgement's
+--                choice for a derived, fully re-derivable row).
+--
+--   reasons_json = SYNTHESISED, not carried. One repo row's reason text does not describe a
+--                workspace verdict, the field is advisory display evidence, and the next
+--                classification pass overwrites it for every non-manual row. Carrying it would
+--                need a per-dialect "pick one row" statement (sqlite bare-columns vs pg
+--                DISTINCT ON) for text nobody reads twice. ⚠ A fold where a manual row LOST gets
+--                an explicit conflict string ("⚠ conflicting per-repo judgements were merged —
+--                review this"), so the one case where a human's judgement was superseded is
+--                visible on the card rather than inferred from a mismatched provenance flag.
+--
+--   kind, label, identity_source = copied from the actor's account_reviewers row. Account-grain
+--                today, so they REPLICATE into each workspace the actor appears in. That
+--                replication is the accepted consequence of the merge: from here on they are
+--                per-workspace facts and may legitimately diverge.
+--   monthly_cents = copied into every workspace row of that actor, on exactly the same footing.
+--                This is the faithful carry-over of a value that WAS account-wide — a ONE-TIME
+--                SEED, not an invariant. From here on price is a per-workspace fact like kind and
+--                label: `setReviewerCost` writes ONE row, nothing fans out, nothing seeds a later
+--                row, and the copies diverge freely as the user edits them.
+--
+-- Actors with an account_reviewers row but NO repo_reviewers row anywhere are DROPPED — the
+-- listing has always been row-driven, and such an identity could never be displayed, edited or
+-- cleared (the same rule the 404 on the old identity route enforced).
+--
+-- ── ON RE-RUNNING THIS FILE ─────────────────────────────────────────────────────────────────
+-- The legacy sources are STUBBED, exactly as 0044 stubs `teams`, so the backfill is a legal empty
+-- statement on a database where they have already gone. `repo_reviewers` and `account_reviewers`
+-- are DROPPED at the bottom: leaving either would leave a second, differently-keyed answer to the
+-- same question sitting in every database.
+
+CREATE TABLE IF NOT EXISTS `repo_reviewers` (
+	`account_id` integer, `repo_id` integer, `author_user_id` integer, `automated` integer,
+	`role` text, `confidence` text, `source` text, `reasons_json` text, `updated_at` integer
+);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `account_reviewers` (
+	`account_id` integer, `author_user_id` integer, `kind` text, `label` text,
+	`identity_source` text, `monthly_cents` integer
+);--> statement-breakpoint
+
+CREATE TABLE IF NOT EXISTS `workspace_reviewers` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`author_user_id` integer NOT NULL,
+	`automated` integer NOT NULL,
+	`role` text DEFAULT 'review' NOT NULL,
+	`confidence` text NOT NULL,
+	`source` text NOT NULL,
+	`reasons_json` text,
+	`kind` text,
+	`label` text,
+	`identity_source` text DEFAULT 'auto' NOT NULL,
+	`monthly_cents` integer,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `workspace_reviewers_workspace_account_fk` FOREIGN KEY (`workspace_id`,`account_id`) REFERENCES `workspaces`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`author_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `workspace_reviewers_account_workspace_author` ON `workspace_reviewers` (`account_id`,`workspace_id`,`author_user_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `workspace_reviewers_account_workspace_idx` ON `workspace_reviewers` (`account_id`,`workspace_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `workspace_reviewers_account_author_idx` ON `workspace_reviewers` (`account_id`,`author_user_id`);--> statement-breakpoint
+
+INSERT INTO `workspace_reviewers`
+  (`account_id`, `workspace_id`, `author_user_id`, `automated`, `role`, `confidence`, `source`,
+   `reasons_json`, `kind`, `label`, `identity_source`, `monthly_cents`, `updated_at`)
+SELECT f.`account_id`, f.`workspace_id`, f.`author_user_id`,
+       f.`aut`,
+       CASE WHEN f.`any_review` = 1 THEN 'review' ELSE 'quality_check' END,
+       CASE WHEN f.`aut` = 1 THEN
+              CASE f.`conf_aut` WHEN 3 THEN 'high' WHEN 2 THEN 'medium' ELSE 'low' END
+            ELSE
+              CASE f.`conf_any` WHEN 3 THEN 'high' WHEN 2 THEN 'medium' ELSE 'low' END
+       END,
+       -- source: 'manual' if ANY contributing row was manual (the pin survives, visibly);
+       -- otherwise the winning row's OWN source — a real ClassificationSource member, never 'auto'.
+       CASE WHEN f.`manual_any` = 1 THEN 'manual' ELSE COALESCE((
+              SELECT rr2.`source`
+                FROM `repo_reviewers` rr2
+                JOIN `workspace_repos` wr2
+                  ON wr2.`repo_id` = rr2.`repo_id` AND wr2.`account_id` = rr2.`account_id`
+               WHERE rr2.`account_id`     = f.`account_id`
+                 AND wr2.`workspace_id`   = f.`workspace_id`
+                 AND rr2.`author_user_id` = f.`author_user_id`
+                 AND rr2.`automated`      = f.`aut`
+               ORDER BY CASE rr2.`confidence` WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC,
+                        rr2.`updated_at` DESC, rr2.`repo_id` ASC
+               LIMIT 1), 'fingerprint') END,
+       CASE WHEN f.`aut` = 1 AND f.`manual_aut` = 1
+              THEN '["manually tagged as an automated reviewer"]'
+            WHEN f.`aut` = 0 AND f.`manual_any` = 1
+              THEN '["manually confirmed as a human"]'
+            -- The one lossy case, named out loud on the card rather than left to be inferred.
+            WHEN f.`manual_any` = 1
+              THEN '["migrated from the per-repo classification","⚠ conflicting per-repo judgements were merged — review this"]'
+            ELSE '["migrated from the per-repo classification"]' END,
+       ar.`kind`, ar.`label`, COALESCE(ar.`identity_source`, 'auto'), ar.`monthly_cents`,
+       f.`upd`
+  FROM (
+    SELECT rr.`account_id`                                                    AS `account_id`,
+           wr.`workspace_id`                                                  AS `workspace_id`,
+           rr.`author_user_id`                                                AS `author_user_id`,
+           MAX(rr.`automated`)                                                AS `aut`,
+           -- COALESCE: the live column is NOT NULL DEFAULT 'review', but the legacy-source STUB
+           -- above declares `role text` NULLABLE, and SQL three-valued logic sends a NULL role to
+           -- ELSE 0 — i.e. every reviewer folds to 'quality_check' on a stub replay.
+           MAX(CASE WHEN COALESCE(rr.`role`,'review') <> 'quality_check' THEN 1 ELSE 0 END) AS `any_review`,
+           MAX(CASE WHEN rr.`automated` = 1
+                    THEN CASE rr.`confidence` WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END
+                    ELSE 0 END)                                               AS `conf_aut`,
+           MAX(CASE rr.`confidence` WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END) AS `conf_any`,
+           MAX(CASE WHEN rr.`source` = 'manual' AND rr.`automated` = 1 THEN 1 ELSE 0 END) AS `manual_aut`,
+           MAX(CASE WHEN rr.`source` = 'manual' THEN 1 ELSE 0 END)            AS `manual_any`,
+           MAX(rr.`updated_at`)                                              AS `upd`
+      FROM `repo_reviewers` rr
+      JOIN `workspace_repos` wr
+        ON wr.`repo_id` = rr.`repo_id` AND wr.`account_id` = rr.`account_id`
+     GROUP BY rr.`account_id`, wr.`workspace_id`, rr.`author_user_id`
+  ) f
+  LEFT JOIN `account_reviewers` ar
+    ON ar.`account_id` = f.`account_id` AND ar.`author_user_id` = f.`author_user_id`
+ WHERE true
+ON CONFLICT (`account_id`, `workspace_id`, `author_user_id`) DO NOTHING;--> statement-breakpoint
+
+DROP TABLE IF EXISTS `repo_reviewers`;--> statement-breakpoint
+DROP TABLE IF EXISTS `account_reviewers`;

package/dist/db/migrations/0046_drop_inbox_watch.sql

@@ -0,0 +1,25 @@
+-- Drop the "watched" concept, SQLite / local mode.
+--
+-- `repos.inbox_watch` / `repos.inbox_watch_started_at` were a SECOND visibility axis on top of
+-- "is this repo added to the account": a repo could be added-but-not-in-my-inbox, and the Feed,
+-- recent activity, My Turn and the Pro digest collection all quietly narrowed to the watched
+-- subset. With Workspaces the Workspace IS the scope, so that second axis only made it
+-- ambiguous which of the two a screen was obeying. Every repo in a Workspace is now fully live.
+--
+-- The one property the watch window actually bought — adding a repo with 400 open PRs must not
+-- dump them all into My Turn on day one — is preserved by keying the "New PRs" section on
+-- `repos.created_at` (when the repo was ADDED) instead of `inbox_watch_started_at`. That column
+-- already exists, is NOT NULL, and is set on insert, so there is no backfill and no window to
+-- reconstruct: an existing repo keeps the cutoff it was added at.
+--
+-- Neither column is a PK, UNIQUE, indexed, or named in any partial index / CHECK / FK /
+-- generated column (verified against the real dev DB: the four indexes on `repos` are
+-- repos_account_owner_name, repos_account_node, repos_account_idx, repos_id_account, and none
+-- mentions either column), so SQLite's plain ALTER TABLE ... DROP COLUMN is legal here and no
+-- 12-step table rebuild is needed.
+--
+-- NOT re-runnable: SQLite has no `DROP COLUMN IF EXISTS` (the pg twin uses one). drizzle's
+-- migrator records each file once, so that is fine — but do not hand-replay this one.
+-- Postgres twin: migrations-pg/0033_drop_inbox_watch.sql.
+ALTER TABLE `repos` DROP COLUMN `inbox_watch`;--> statement-breakpoint
+ALTER TABLE `repos` DROP COLUMN `inbox_watch_started_at`;

package/dist/db/migrations/0047_ml_comment_labels.sql

@@ -0,0 +1,40 @@
+-- ML severity/category labels for BOT-authored text (CORE, free tier, no LLM). One row per
+-- classified target — a review-thread comment, a PR comment, or a review BODY. Written only by
+-- the background enrichment worker (sync/ml-enrichment.ts), which batches text to the
+-- `severity-api` microservice from the sibling `pierre-ml` repo; read by the per-PR badge index
+-- and the Bots severity rollup. Contract: docs/ML-SEVERITY.md.
+--
+-- `target_id` is NOT a foreign key: it lives in three different id spaces (review_comments.id /
+-- pr_comments.id / reviews.id), so `target_kind` is part of the unique. Cleanup rides the
+-- cascading `pr_id` FK — deleting a PR takes its labels with it — which is why this table is
+-- deliberately absent from deleteRepo and deletePrSubtree (the `search_index` precedent).
+-- The Postgres twin is migrations-pg/0034_ml_comment_labels.sql.
+CREATE TABLE IF NOT EXISTS `ml_comment_labels` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`target_kind` text NOT NULL,
+	`target_id` integer NOT NULL,
+	`author_user_id` integer NOT NULL,
+	`severity` text NOT NULL,
+	`severity_ord` integer NOT NULL,
+	`severity_prob` real NOT NULL,
+	`categories` text NOT NULL,
+	`category_probs` text NOT NULL,
+	`is_summary` integer NOT NULL,
+	`backend` text NOT NULL,
+	`model_version` text NOT NULL,
+	`body_hash` text NOT NULL,
+	`target_created_at` integer NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`repo_id`) REFERENCES `repos`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`pr_id`) REFERENCES `pull_requests`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`author_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `mcl_account_target` ON `ml_comment_labels` (`account_id`,`target_kind`,`target_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `mcl_account_pr_idx` ON `ml_comment_labels` (`account_id`,`pr_id`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `mcl_account_repo_author_idx` ON `ml_comment_labels` (`account_id`,`repo_id`,`author_user_id`);

package/dist/db/migrations/0048_ml_vendor_severity.sql

@@ -0,0 +1,31 @@
+-- The REVIEW BOT'S OWN declared severity, stored beside ours. SQLite / local mode; Postgres
+-- twin: migrations-pg/0035_ml_vendor_severity.sql. Two additive nullable columns on
+-- `ml_comment_labels`, no index, no backfill.
+--
+-- WHAT THESE ARE. CodeRabbit et al. stamp their own severity into their comment markup
+-- ("**Major**", a badge, a table cell). The severity-api's deterministic marker reader already
+-- extracts it and we were discarding it. `vendor_severity` is that claim verbatim (the four
+-- values our own scale uses, lowercased at the wire boundary); `vendor_severity_confidence`
+-- is how sure the reader is that it read a real declared badge rather than inferring one from
+-- prose.
+--
+-- WHAT THEY ARE NOT: an input to our own label. Measured on `gold_v2_sample` (300 comments,
+-- fresh label-free adjudication, marker-stratified, held out properly) our model scores 0.700
+-- exact / 0.303 ordinal MAE while the vendor's own badge scores 0.474 / 0.697 — the bot's
+-- self-assessment is materially WORSE than the model sitting next to it. So nothing derives,
+-- corrects or falls back to these columns. They exist to be DISPLAYED alongside ours
+-- ("CodeRabbit: Major · Pierre: Minor"), because the disagreement is the product.
+--
+-- BOTH ARE NULLABLE, for two independent reasons that must not be conflated:
+--   1. most comments simply carry no vendor badge — null is the ordinary case, not a gap;
+--   2. an OLDER severity-api build omits the response fields entirely, and that has to degrade
+--      to null silently rather than throw (the client reads them defensively).
+-- Neither is distinguishable from the other after the fact, and neither needs to be: a null
+-- renders nothing.
+--
+-- No index: the values are read out of an already-fetched label row (the per-PR badge index),
+-- never used as a predicate. No backfill either — an existing label is never re-scored (see
+-- docs/ML-SEVERITY.md § known gaps), so historical rows keep NULL until `pnpm ml:enrich --reset`
+-- refills them. Until then a badge with no vendor claim renders exactly as it does today.
+ALTER TABLE `ml_comment_labels` ADD `vendor_severity` text;--> statement-breakpoint
+ALTER TABLE `ml_comment_labels` ADD `vendor_severity_confidence` text;

package/dist/db/migrations/0049_seat_pricing_repo_description.sql

@@ -0,0 +1,21 @@
+-- Per-seat bot pricing + repo descriptions. SQLite / local mode; Postgres twin:
+-- migrations-pg/0036_seat_pricing_repo_description.sql. Two additive columns, no index,
+-- no backfill.
+--
+-- `workspace_reviewers.cost_model` — how `monthly_cents` is READ, never a second price.
+-- 'flat' (the default, preserving every existing row's meaning) = the whole workspace
+-- subscription, exactly as before. 'per_seat' = `monthly_cents` is a per-seat UNIT price
+-- (e.g. CodeRabbit's $29/user/month) multiplied on read by the workspace's derived human
+-- seat count (distinct human PR authors in the workspace's repos over a trailing window).
+-- The product is NEVER stored: seats × cents can exceed int4 and would go stale the moment
+-- a new contributor opens a PR. Ownership is identical to `monthly_cents`: one writer
+-- (`setReviewerCost`), one standalone cost route, never in any derived UPDATE, never in the
+-- combined PATCH body.
+--
+-- `repos.description` — the repo's GitHub "About" text, captured by the activity sync like
+-- `default_branch` / `viewer_permission`. It exists as grounding for the workspace-purpose
+-- sprint-chat preset ("what does this workspace do?"): the app persists no other repo-purpose
+-- text (READMEs are never fetched, PR bodies are lean). Nullable — null until a sync
+-- populates it, or when the repo has no description on GitHub.
+ALTER TABLE `repos` ADD `description` text;--> statement-breakpoint
+ALTER TABLE `workspace_reviewers` ADD `cost_model` text DEFAULT 'flat' NOT NULL;

package/dist/db/migrations/0050_users_app_slug.sql

@@ -0,0 +1,12 @@
+-- Bot Tuning Advisor discovery: capture the GitHub App slug behind a bot's comments.
+-- SQLite / local mode; Postgres twin: migrations-pg/0037_users_app_slug.sql. One additive
+-- nullable column, no index, no backfill.
+--
+-- `users.app_slug` — the `performed_via_github_app.slug` the app-attribution probe
+-- (sync/app-attribution.ts) has always RECEIVED and, until now, discarded down to a
+-- PR-level boolean. A bot's App identity is a global fact about the actor (like
+-- `github_type`), so it lives on the global `users` table. The advisor's discovery tier
+-- reads it to split App-authored from Actions-authored comments. Null = never observed
+-- (PAT/OAuth posters have no app); an observed slug is never cleared by a later app-less
+-- comment — the write path only fills nulls or updates to a NEW slug, never nulls out.
+ALTER TABLE `users` ADD `app_slug` text;

package/dist/db/migrations/0051_auto_merge_queue.sql

@@ -0,0 +1,17 @@
+-- Auto-merge ("merge when ready") learns GitHub's native merge queue. SQLite / local mode;
+-- Postgres twin: migrations-pg/0038_auto_merge_queue.sql. Two additive columns, no index,
+-- no backfill (existing intents are direct-merge intents — via_merge_queue defaults false).
+--
+-- `via_merge_queue` — stamped at arm time when the PR's base branch had a merge queue: the
+-- watcher's terminal action is then "add to the queue" (GraphQL enqueuePullRequest, pinned
+-- to the consented head) instead of a direct merge, which GitHub refuses on a
+-- queue-protected branch. The runner re-checks the queue live each tick, so a queue
+-- disabled after arming degrades to the direct merge rather than stranding the intent.
+--
+-- `enqueued_at` — when the WATCHER enqueued the PR; null until then. This is the
+-- attribution record: a PR that merges while it is set resolves 'merged' (the watcher's
+-- doing — the landed toast fires), one a human queued resolves 'disarmed_blocked' like any
+-- outside merge, and a disarm with it set also dequeues the entry the watcher created.
+ALTER TABLE `auto_merge_requests` ADD `via_merge_queue` integer DEFAULT 0 NOT NULL;
+--> statement-breakpoint
+ALTER TABLE `auto_merge_requests` ADD `enqueued_at` integer;

package/dist/db/migrations/0052_trunk_ci_status_events.sql

@@ -0,0 +1,43 @@
+-- Default-branch ("trunk") CI TRANSITION log. SQLite / local mode; Postgres twin:
+-- migrations-pg/0039_trunk_ci_status_events.sql. One additive table, no backfill.
+--
+-- WHY IT HAS TO EXIST. `branch_commits.ci_status` is updated IN PLACE by the branch snapshot's
+-- idempotent upsert, so a trunk commit that turns red hours after it landed carries no record of
+-- WHEN it turned red: the only timestamps on that row are `committed_at` (git commit time) and
+-- `created_at` (first insertion). Presenting either as "trunk CI failed at" would be a quiet
+-- lie, so the observation gets its own append-only row. This is the trunk twin of
+-- `ci_status_events`, which does exactly the same job for a PR head.
+--
+-- WRITE RULES (sync/branch-status.ts): a row is written only on a TRANSITION (status / head sha
+-- / failing-check name set differs from this repo's last row) AND only on a POSITIVE statement
+-- from GitHub — an `unknown` rollup, which is also what `graphqlTolerant` produces when a
+-- partial response NULLs the selection, records nothing at all. `observed_at` is OUR observation
+-- time (the branch query selects no `completedAt`), so UI wording says "detected".
+--
+-- `failing_checks` carries the FULL BranchCheckRun[] render payload, matching
+-- `branch_commits.failing_checks` — deliberately NOT `ci_status_events.failing_checks`, which is
+-- a bare string[] of names for the CI metrics log. Same column name, different shape, on purpose.
+--
+-- Retention: bounded by its own per-repo trim in the writer, because the time-based sweep anchors
+-- everything to a parent PR's `updated_at` and a trunk row has no PR. That trim is HYBRID — the
+-- newest TRUNK_CI_EVENT_WINDOW rows UNION everything still inside FEED_WINDOW_DAYS
+-- (`staleTrunkCiEventIds`) — exactly like `branch_commits`, and for opposite reasons in each
+-- direction: a pure COUNT bound evicted the failure rows the Feed reads on repos that sync faster
+-- than the read window elapses, and a pure AGE bound would delete a dormant repo's entire log.
+-- FKs CASCADE so a repo delete / account erasure cleans up regardless; both are ALSO done
+-- explicitly (deleteRepo / eraseAccountData) so the guarantee doesn't depend on `foreign_keys=ON`.
+CREATE TABLE IF NOT EXISTS `trunk_ci_status_events` (
+  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  `account_id` integer NOT NULL REFERENCES `accounts`(`id`) ON DELETE cascade,
+  `repo_id` integer NOT NULL REFERENCES `repos`(`id`) ON DELETE cascade,
+  `branch_name` text,
+  `head_sha` text NOT NULL,
+  `status` text NOT NULL,
+  `failing_checks` text,
+  `observed_at` integer NOT NULL
+);
+--> statement-breakpoint
+-- The read (the Feed builder) and the per-repo trim: one repo's log, newest first.
+CREATE INDEX IF NOT EXISTS `tcse_account_repo_observed` ON `trunk_ci_status_events` (`account_id`,`repo_id`,`observed_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `tcse_account_idx` ON `trunk_ci_status_events` (`account_id`);

package/dist/db/migrations/0053_automation_roles.sql

@@ -0,0 +1,79 @@
+-- Re-derive `workspace_reviewers.role` against the five automation vocabularies.
+--
+-- WHY A MIGRATION IS REQUIRED AND NOT JUST A LONGER LIST IN CODE.
+--
+-- `reviewerRoleForUser` applies the login seed FIRST and then lets a stored `workspace_reviewers`
+-- row overwrite it. That ordering is correct — an explicit row must beat a default — but it means
+-- adding a login to `QUALITY_CHECK_BOTS` (or to any of the four new lists) has NO EFFECT on an
+-- actor that has already been classified, and the lazy classifier stamps a row the first time
+-- anyone opens the Bots tab. So on any install that has used the product, `github-actions` keeps
+-- the `role: 'review'` it was given when 'review' was the only fallback, and stays in the
+-- AI-reviewer ROI cohort no matter what the code says.
+--
+-- Measured on the dev corpus before this ran: `github-actions` + `github-actions[bot]` held 385
+-- submitted reviews and 3,116 comments between them while roled 'review' — the single largest
+-- "AI reviewer" in the account was a CI runner. `dependabot`/`dependabot[bot]` (738 authored PRs)
+-- were roled 'review' as well, an actor that has never reviewed anything.
+--
+-- `source <> 'manual'` is the whole safety condition: a role a PERSON chose is never re-derived,
+-- exactly as migration 0042's backfill had it. The judgement half is owned by `source`.
+--
+-- The `[bot]` suffix is stripped rather than each login being listed twice, because the SAME
+-- ACTOR exists as two `users` rows on real accounts (`dependabot` and `dependabot[bot]` have
+-- different GitHub node ids) and a list that covers one spelling and not the other splits an
+-- actor across two roles. `replace()` is safe here: no GitHub login may contain `[` or `]`, so
+-- the substring can only ever appear as the suffix. The Postgres twin uses `regexp_replace(…,
+-- '\[bot\]$', '')`, which is the same operation spelled in that dialect's idiom.
+UPDATE `workspace_reviewers`
+SET `role` = 'dependency'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN (
+      'dependabot', 'dependabot-preview', 'renovate', 'renovate-bot',
+      'snyk-bot', 'pyup-bot', 'greenkeeper', 'depfu'
+    )
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'code_agent'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN (
+      'devin-ai-integration', 'sweep-ai', 'codegen-sh', 'deepsource-autofix',
+      'pre-commit-ci', 'restyled-io', 'imgbot', 'imgbotapp',
+      'transifex-integration', 'crowdin-bot', 'mintlify', 'allstar'
+    )
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'release'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN (
+      'mergify', 'kodiak', 'kodiakhq', 'bulldozer', 'release-please', 'releaser',
+      'semantic-release', 'semantic-release-bot', 'release-drafter', 'changeset-bot',
+      'changesets', 'autorelease', 'lumberbot-app', 'meeseeksdev', 'backport'
+    )
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'housekeeping'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN (
+      'cla-bot', 'cla-assistant', 'claassistant', 'google-cla', 'googlebot',
+      'facebook-github-bot', 'dco', 'stale', 'welcome', 'lock', 'allcontributors',
+      'semantic-pull-request', 'sizebot', 'react-sizebot', 'diffray-bot',
+      'codesandbox-ci', 'netlify', 'vercel', 'gitpod-io'
+    )
+  );--> statement-breakpoint
+-- Last, and it supersedes 0042's narrower list rather than repeating it: the eight original
+-- static-analysis logins plus the CI runners and security scanners added alongside the new roles.
+UPDATE `workspace_reviewers`
+SET `role` = 'quality_check'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN (
+      'sonarqubecloud', 'sonarcloud', 'codecov', 'codeclimate', 'codefactor-io',
+      'houndci-bot', 'coveralls', 'codacy-bot',
+      'github-actions', 'jit-ci', 'socket-security', 'gitguardian',
+      'semgrep-app', 'trunk-io'
+    )
+  );