limn-review 0.1.126 → 0.1.127

package/dist/config.js

@@ -536,6 +536,9 @@ export const config = {
     // every member's worktree.
     ticketReviewBudgetUsd: floatFromEnv('TICKET_REVIEW_BUDGET_USD', 4),
     ticketReviewMaxTurns: intFromEnv('TICKET_REVIEW_MAX_TURNS', 40),
+    // The per-card spend cap of the ticket review's CARD PRE-PASS (Sonnet 5, diff-only, one tool —
+    // review/ticket-review/prepass.ts). Its spend is added to the ticket run's cost. Env only.
+    ticketCardBudgetUsd: floatFromEnv('TICKET_CARD_BUDGET_USD', 0.4),
     // AUTOMATIC ticket reviews (trigger 'auto' / 'cascade') per workspace per UTC day. Not shared with
     // the PR review's own auto cap. Manual runs never count. Default = shared TICKET_REVIEW_DAILY_CAP.
     ticketReviewDailyCap: intFromEnv('TICKET_REVIEW_DAILY_CAP', 20),

package/dist/db/erase-account.js

@@ -128,6 +128,12 @@ export async function eraseAccountData(accountId) {
             .delete(schema.ticketReviews)
             .where(eq(schema.ticketReviews.accountId, accountId))
             .execute();
+        // Ticket review contribution cards (migration 0086 / pg 0073): model text describing the user's
+        // PRs. The repo loop has normally taken them with their PRs; explicit, like every agentic table.
+        await tx
+            .delete(schema.ticketReviewPrCards)
+            .where(eq(schema.ticketReviewPrCards.accountId, accountId))
+            .execute();
         // CI reviews (migration 0082 / pg 0069), items first. The repo loop has normally taken them with
         // their PRs; explicit, like every agentic table.
         await tx
@@ -218,6 +224,12 @@ export function accountScopedTables() {
             col: schema.ticketReviewItems.accountId,
             table: schema.ticketReviewItems,
         },
+        // Contribution cards (migration 0086 / pg 0073) — one per (PR, head); erased explicitly above.
+        {
+            name: 'ticketReviewPrCards',
+            col: schema.ticketReviewPrCards.accountId,
+            table: schema.ticketReviewPrCards,
+        },
         // CI reviews (migration 0082 / pg 0069) — the runs and their per-check items. Both carry their
         // own accountId; both are erased explicitly above.
         { name: 'ciReviews', col: schema.ciReviews.accountId, table: schema.ciReviews },

package/dist/db/migrations/0084_auto_fix_off_by_default.sql

@@ -0,0 +1,7 @@
+-- AUTO AI FIX IS OFF BY DEFAULT. 0083 added `workspaces.auto_fix_enabled` DEFAULT 1 so nothing
+-- changed on upgrade; the product decision since is OFF until someone switches it on. Every
+-- existing workspace is switched off once here (the switch shipped one release earlier, so no one
+-- has had time to choose it). SQLite cannot change a column default in place, so the 0083 DDL
+-- default stays 1; both workspace inserts in db/queries.ts write `autoFixEnabled: false`
+-- explicitly. The Postgres twin is migrations-pg/0071_auto_fix_off_by_default.sql.
+UPDATE `workspaces` SET `auto_fix_enabled` = 0;

package/dist/db/migrations/0085_auto_review_daily_cap.sql

@@ -0,0 +1,6 @@
+-- AUTO REVIEW DAILY CAP, PER WORKSPACE. How many auto Claude reviews a workspace may start per UTC
+-- day. OVERRIDES ONLY: NULL = the product default (20, `AUTO_REVIEW_DAILY_CAP`), resolved through
+-- `resolveAutoReviewDailyCap` (review/claude-review/auto-settings.ts); the PUT route bounds it
+-- 1..500. Nullable with no default, so no workspace insert has to name it. The Postgres twin is
+-- migrations-pg/0072_auto_review_daily_cap.sql.
+ALTER TABLE `workspaces` ADD `auto_review_daily_cap` integer;

package/dist/db/migrations/0086_ticket_review_pr_cards.sql

@@ -0,0 +1,24 @@
+-- TICKET REVIEW CONTRIBUTION CARDS. One row per (account, PR, head commit): a model-written,
+-- verdict-free description of what that PR's head does (summary, interfaces, the story criteria it
+-- moves forward, loose ends) plus the PR's changed files at that head (server-written). A ticket
+-- review reads a member whose CURRENT head has a card as the card, not as its diff; the run writes a
+-- card for every member it read as a diff (source 'story_check') and a cheap per-PR pre-pass writes
+-- the overflow (source 'prepass', with its own cost). Re-writing the same head replaces the card.
+-- Tenancy: a composite FK against pull_requests(id, account_id). Both delete paths (deleteRepo,
+-- retention's deletePrSubtree, via db/ticket-review-prune.ts) and eraseAccountData delete these rows
+-- explicitly. The Postgres twin is migrations-pg/0073_ticket_review_pr_cards.sql.
+CREATE TABLE IF NOT EXISTS `ticket_review_pr_cards` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`head_sha` text NOT NULL,
+	`card` text NOT NULL,
+	`source` text NOT NULL,
+	`model` text NOT NULL,
+	`cost_usd` real,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `trpc_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `trpc_account_pr_head_ux` ON `ticket_review_pr_cards` (`account_id`,`pr_id`,`head_sha`);

package/dist/db/migrations/0087_auto_post.sql

@@ -0,0 +1,21 @@
+-- AUTO-POSTING OF CLAUDE REVIEW OUTPUT (review/claude-review/auto-post.ts, review/ticket-review/
+-- auto-post.ts). A per-workspace master switch, OFF for every workspace existing and new, plus the
+-- per-run records of what was posted and the per-item "posted automatically" flag.
+--   workspaces.auto_post_enabled      NULL/false = off. Nullable, no default: no insert names it.
+--   workspaces.auto_post_settings     JSON, OVERRIDES ONLY ({ scope?, kinds? }); NULL = defaults.
+--   claude_reviews.auto_post          JSON ClaudeAutoPostRecord; NULL = never looked at.
+--   claude_review_findings.posted_auto  true = posted by auto-posting.
+--   ticket_reviews.auto_post          JSON TicketAutoPostRecord; NULL = never looked at.
+--   ticket_review_items.posted_auto   true = posted by auto-posting (carried with the posting).
+-- The Postgres twin is migrations-pg/0074_auto_post.sql.
+ALTER TABLE `workspaces` ADD `auto_post_enabled` integer;
+--> statement-breakpoint
+ALTER TABLE `workspaces` ADD `auto_post_settings` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `claude_review_findings` ADD `posted_auto` integer;
+--> statement-breakpoint
+ALTER TABLE `ticket_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `ticket_review_items` ADD `posted_auto` integer;

package/dist/db/migrations/meta/_journal.json

@@ -589,6 +589,34 @@
       "when": 1790665200000,
       "tag": "0083_workspace_auto_fix",
       "breakpoints": true
+    },
+    {
+      "idx": 84,
+      "version": "6",
+      "when": 1790751600000,
+      "tag": "0084_auto_fix_off_by_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 85,
+      "version": "6",
+      "when": 1790838000000,
+      "tag": "0085_auto_review_daily_cap",
+      "breakpoints": true
+    },
+    {
+      "idx": 86,
+      "version": "6",
+      "when": 1790841600000,
+      "tag": "0086_ticket_review_pr_cards",
+      "breakpoints": true
+    },
+    {
+      "idx": 87,
+      "version": "6",
+      "when": 1790928000000,
+      "tag": "0087_auto_post",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0071_auto_fix_off_by_default.sql

@@ -0,0 +1,5 @@
+-- Postgres twin of migrations/0084_auto_fix_off_by_default.sql: auto AI Fix is OFF by default,
+-- and every existing workspace is switched off once.
+ALTER TABLE "workspaces" ALTER COLUMN "auto_fix_enabled" SET DEFAULT false;
+--> statement-breakpoint
+UPDATE "workspaces" SET "auto_fix_enabled" = false;

package/dist/db/migrations-pg/0072_auto_review_daily_cap.sql

@@ -0,0 +1,3 @@
+-- Postgres twin of migrations/0085_auto_review_daily_cap.sql: the per-workspace auto review daily
+-- cap. NULL = the default 20.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_review_daily_cap" integer;

package/dist/db/migrations-pg/0073_ticket_review_pr_cards.sql

@@ -0,0 +1,17 @@
+-- Postgres twin of migrations/0086_ticket_review_pr_cards.sql: ticket review contribution cards,
+-- one row per (account, PR, head commit). The contract lives in schema.sqlite.ts.
+CREATE TABLE IF NOT EXISTS "ticket_review_pr_cards" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"head_sha" text NOT NULL,
+	"card" jsonb NOT NULL,
+	"source" text NOT NULL,
+	"model" text NOT NULL,
+	"cost_usd" double precision,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ticket_review_pr_cards_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "trpc_pr_account_fk" FOREIGN KEY ("pr_id","account_id") REFERENCES "pull_requests"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "trpc_account_pr_head_ux" ON "ticket_review_pr_cards" USING btree ("account_id","pr_id","head_sha");

package/dist/db/migrations-pg/0074_auto_post.sql

@@ -0,0 +1,14 @@
+-- Postgres twin of migrations/0087_auto_post.sql: auto-posting of Claude review output. A
+-- per-workspace switch (NULL/false = off) + overrides-only settings, the per-run records and the
+-- per-item "posted automatically" flags. The contract lives in schema.sqlite.ts.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_enabled" boolean;
+--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_settings" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_review_findings" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;
+--> statement-breakpoint
+ALTER TABLE "ticket_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "ticket_review_items" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;

package/dist/db/migrations-pg/meta/_journal.json

@@ -498,6 +498,34 @@
       "when": 1790665200000,
       "tag": "0070_workspace_auto_fix",
       "breakpoints": true
+    },
+    {
+      "idx": 71,
+      "version": "7",
+      "when": 1790751600000,
+      "tag": "0071_auto_fix_off_by_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 72,
+      "version": "7",
+      "when": 1790838000000,
+      "tag": "0072_auto_review_daily_cap",
+      "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1790841600000,
+      "tag": "0073_ticket_review_pr_cards",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1790928000000,
+      "tag": "0074_auto_post",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/queries.js

@@ -253,7 +253,7 @@ export async function ensureDefaultWorkspace(accountId) {
             : `Default (workspace ${accountId})`;
     await db
         .insert(workspaces)
-        .values({ accountId, name, isDefault: true })
+        .values({ accountId, name, isDefault: true, autoFixEnabled: false })
         .onConflictDoNothing()
         .execute();
     const after = await readDefault();
@@ -336,7 +336,7 @@ export async function listWorkspaces(accountId) {
 export async function createWorkspace(accountId, name) {
     const [row] = await db
         .insert(workspaces)
-        .values({ accountId, name, isDefault: false })
+        .values({ accountId, name, isDefault: false, autoFixEnabled: false })
         .returning()
         .execute();
     // No repos yet, so no repo-grained mutes to intersect — and `pending_muted` defaults to false.
@@ -14792,4 +14792,15 @@ export async function updateAutoMergeState(id, opts) {
         .where(eq(autoMergeRequests.id, id))
         .execute();
 }
+/**
+ * Is this user automation IN THIS WORKSPACE — the same union `hiddenBotUserIds` hides (a manual
+ * "this is a human" wins both directions)? Read by auto-posting (review/claude-review/auto-post.ts),
+ * which never posts on a bot-authored PR. A null user (an unmapped author) answers TRUE: a PR whose
+ * author we cannot place is not one we write on.
+ */
+export async function isWorkspaceAutomationUser(accountId, workspaceId, userId) {
+    if (userId == null)
+        return true;
+    return (await hiddenBotUserIds(accountId, workspaceId)).includes(userId);
+}
 //# sourceMappingURL=queries.js.map

package/dist/db/schema.pg.js

@@ -726,6 +726,8 @@ export const claudeReviews = pgTable('claude_reviews', {
     commentsThrough: timestamp('comments_through', { withTimezone: true, mode: 'date' }),
     // Failed CI on the reviewed head, diagnosed. Twin of schema.sqlite.ts. Migration pg 0064 (sqlite 0077).
     ciFailures: jsonb('ci_failures').$type(),
+    // What auto-posting did with this run (migration 0087 / pg 0074). Twin of schema.sqlite.ts.
+    autoPost: jsonb('auto_post').$type(),
 }, (t) => ({
     prIdx: index('cr_pr_idx').on(t.prId),
     prShaIdx: index('cr_pr_sha_idx').on(t.prId, t.headSha),
@@ -779,6 +781,8 @@ export const claudeReviewFindings = pgTable('claude_review_findings', {
     // 0066 (sqlite 0079).
     storyIndex: integer('story_index'),
     storyRef: text('story_ref'),
+    // Posted by auto-posting (migration 0087 / pg 0074). Twin of schema.sqlite.ts.
+    postedAuto: boolean('posted_auto'),
 }, (t) => ({ reviewIdx: index('crf_review_idx').on(t.reviewId) }));
 // Claude Review chat messages. Twin of schema.sqlite.ts claudeReviewChatMessages, where the
 // contract lives. Migration pg 0060 (sqlite 0073).
@@ -855,6 +859,8 @@ export const ticketReviews = pgTable('ticket_reviews', {
     summary: text('summary'),
     // The server-validated TicketAssessment. Null unless the run succeeded.
     assessment: jsonb('assessment').$type(),
+    // What auto-posting did with this run (migration 0087 / pg 0074). Twin of schema.sqlite.ts.
+    autoPost: jsonb('auto_post').$type(),
 }, (t) => ({
     accountIdentIdx: index('tr_account_ident_created_idx').on(t.accountId, t.ticketIdent, t.createdAt),
     // The per-workspace daily cap on automatic runs.
@@ -908,6 +914,8 @@ export const ticketReviewItems = pgTable('ticket_review_items', {
     postedPrId: integer('posted_pr_id'),
     postedCommentId: text('posted_comment_id'),
     postedAt: timestamp('posted_at', { withTimezone: true, mode: 'date' }),
+    // Posted by auto-posting (migration 0087 / pg 0074). Twin of schema.sqlite.ts.
+    postedAuto: boolean('posted_auto'),
     priorItemId: integer('prior_item_id'),
     createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' })
         .notNull()
@@ -922,6 +930,30 @@ export const ticketReviewItems = pgTable('ticket_review_items', {
         foreignColumns: [ticketReviews.id, ticketReviews.accountId],
     }).onDelete('cascade'),
 }));
+// ---- Ticket review contribution cards (CORE; pg 0073 / sqlite 0086) ----
+// Twin of schema.sqlite.ts ticketReviewPrCards, where the contract lives.
+export const ticketReviewPrCards = pgTable('ticket_review_pr_cards', {
+    id: serial('id').primaryKey(),
+    accountId: integer('account_id')
+        .notNull()
+        .references(() => accounts.id, { onDelete: 'cascade' }),
+    prId: integer('pr_id').notNull(),
+    headSha: text('head_sha').notNull(),
+    card: jsonb('card').$type().notNull(),
+    source: text('source', { enum: ['story_check', 'prepass'] }).notNull(),
+    model: text('model').notNull(),
+    costUsd: doublePrecision('cost_usd'),
+    createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' })
+        .notNull()
+        .defaultNow(),
+}, (t) => ({
+    accountPrHeadUx: uniqueIndex('trpc_account_pr_head_ux').on(t.accountId, t.prId, t.headSha),
+    prAccountFk: foreignKey({
+        name: 'trpc_pr_account_fk',
+        columns: [t.prId, t.accountId],
+        foreignColumns: [pullRequests.id, pullRequests.accountId],
+    }).onDelete('cascade'),
+}));
 // ---- CI review (CORE; pg 0069 / sqlite 0082) ----
 // Twin of schema.sqlite.ts ciReviews / ciReviewItems, where the contract lives.
 export const ciReviews = pgTable('ci_reviews', {
@@ -1081,7 +1113,13 @@ export const workspaces = pgTable('workspaces', {
     autoReviewEnabled: boolean('auto_review_enabled'),
     autoReviewEnabledAt: timestamp('auto_review_enabled_at', { withTimezone: true, mode: 'date' }),
     // Auto AI Fix (migration 0083 / pg 0070) — the pg twin. DEFAULT true. Rationale in the sqlite twin.
-    autoFixEnabled: boolean('auto_fix_enabled').notNull().default(true),
+    autoFixEnabled: boolean('auto_fix_enabled').notNull().default(false),
+    // Auto review daily cap (migration 0085 / pg 0072) — the pg twin. NULL = the default 20.
+    autoReviewDailyCap: integer('auto_review_daily_cap'),
+    // Auto-posting (migration 0087 / pg 0074) — the pg twin. NULL/false = off; settings are
+    // overrides only. Rationale in the sqlite twin.
+    autoPostEnabled: boolean('auto_post_enabled'),
+    autoPostSettings: jsonb('auto_post_settings').$type(),
     createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' })
         .notNull()
         .defaultNow(),

package/dist/db/schema.sqlite.js

@@ -1007,6 +1007,11 @@ export const claudeReviews = sqliteTable('claude_reviews', {
     // the field, a skip, a run that did not succeed, or one whose checks could not be read.
     // Migration 0077 (pg 0064).
     ciFailures: text('ci_failures', { mode: 'json' }).$type(),
+    // WHAT AUTO-POSTING DID WITH THIS RUN (migration 0087 / pg 0074): written once, by the claim in
+    // review/claude-review/auto-post.ts (`status: 'posting'` BEFORE any GitHub call, so a crash
+    // mid-post can never lead to a retry), then settled to posted / partial / failed / skipped.
+    // NULL = auto-posting never looked at this run (a manual run, or the switch was off).
+    autoPost: text('auto_post', { mode: 'json' }).$type(),
 }, (t) => ({
     prIdx: index('cr_pr_idx').on(t.prId),
     prShaIdx: index('cr_pr_sha_idx').on(t.prId, t.headSha),
@@ -1077,6 +1082,9 @@ export const claudeReviewFindings = sqliteTable('claude_review_findings', {
     // together: a row has both or neither.
     storyIndex: integer('story_index'),
     storyRef: text('story_ref'),
+    // true = auto-posting put this finding on GitHub (migration 0087 / pg 0074); NULL/false = a
+    // person did, or it is not posted. Display only ("Posted automatically").
+    postedAuto: integer('posted_auto', { mode: 'boolean' }),
 }, (t) => ({ reviewIdx: index('crf_review_idx').on(t.reviewId) }));
 // ---- Claude Review chat (CORE table, written by the Pro plugin) ----
 // One row per chat MESSAGE about one succeeded review: a general thread (`finding_id` NULL) and
@@ -1185,6 +1193,9 @@ export const ticketReviews = sqliteTable('ticket_reviews', {
     summary: text('summary'),
     // The server-validated TicketAssessment. Null unless the run succeeded.
     assessment: text('assessment', { mode: 'json' }).$type(),
+    // What auto-posting did with this run (migration 0087 / pg 0074) — review/ticket-review/
+    // auto-post.ts. Also holds the posted "Not asked for" entries, which have no item row.
+    autoPost: text('auto_post', { mode: 'json' }).$type(),
 }, (t) => ({
     accountIdentIdx: index('tr_account_ident_created_idx').on(t.accountId, t.ticketIdent, t.createdAt),
     // The per-workspace daily cap on automatic runs.
@@ -1238,6 +1249,8 @@ export const ticketReviewItems = sqliteTable('ticket_review_items', {
     postedPrId: integer('posted_pr_id'),
     postedCommentId: text('posted_comment_id'),
     postedAt: integer('posted_at', { mode: 'timestamp' }),
+    // true = auto-posting posted it (migration 0087 / pg 0074); carried with the posting.
+    postedAuto: integer('posted_auto', { mode: 'boolean' }),
     priorItemId: integer('prior_item_id'),
     createdAt: integer('created_at', { mode: 'timestamp' })
         .notNull()
@@ -1252,6 +1265,45 @@ export const ticketReviewItems = sqliteTable('ticket_review_items', {
         foreignColumns: [ticketReviews.id, ticketReviews.accountId],
     }).onDelete('cascade'),
 }));
+// ---- Ticket review CONTRIBUTION CARDS (migration 0086, pg 0073) ----
+// One row per (account, PR, head commit): a model-written, verdict-free description of what that
+// PR's head does (shared `TicketPrCard`: summary, interfaces, criteria it moves forward, loose
+// ends) plus the changed files at that head (server-written). Written by a ticket review — its own
+// run for every member it read as a diff (`source = 'story_check'`), or the cheap per-PR pre-pass
+// for the overflow beyond TICKET_REVIEW_MAX_DIFFS (`'prepass'`, with that card's own cost). A later
+// run reads a member whose current head has a card AS THE CARD. Currency is `head_sha` equality
+// with the PR's synced head: a merged PR's head never moves, so its card holds for good.
+// ⚠ Card availability NEVER enters the ticket fingerprint (review/ticket-review/fingerprint.ts).
+// Re-writing the same head replaces the card (upsert on the unique below).
+// Tenancy: a composite FK against pull_requests(id, account_id). ⚠ BOTH DELETE PATHS clear rows for
+// the deleted PRs (db/ticket-review-prune.ts), plus eraseAccountData + accountScopedTables().
+// Twin: schema.pg.ts.
+export const ticketReviewPrCards = sqliteTable('ticket_review_pr_cards', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    accountId: integer('account_id')
+        .notNull()
+        .references(() => accounts.id, { onDelete: 'cascade' }),
+    // Composite FK below (no single-column one).
+    prId: integer('pr_id').notNull(),
+    headSha: text('head_sha').notNull(),
+    card: text('card', { mode: 'json' }).$type().notNull(),
+    source: text('source', { enum: ['story_check', 'prepass'] }).notNull(),
+    // Stored model id (no drizzle `enum:`, like ticket_reviews.model).
+    model: text('model').notNull(),
+    // A pre-pass card's own spend; null for a card written inside a ticket review's run (that run's
+    // cost holds it).
+    costUsd: real('cost_usd'),
+    createdAt: integer('created_at', { mode: 'timestamp' })
+        .notNull()
+        .default(sql `(unixepoch())`),
+}, (t) => ({
+    accountPrHeadUx: uniqueIndex('trpc_account_pr_head_ux').on(t.accountId, t.prId, t.headSha),
+    prAccountFk: foreignKey({
+        name: 'trpc_pr_account_fk',
+        columns: [t.prId, t.accountId],
+        foreignColumns: [pullRequests.id, pullRequests.accountId],
+    }).onDelete('cascade'),
+}));
 // ---- CI review (CORE, local-only like the rest of Claude Review) ----
 // A separate Claude run that explains why checks FAILED on a PR's head — split out of the PR review's
 // own run (`claude_reviews.ci_failures`, now LEGACY and read-only). Two tables, migration 0082
@@ -1474,7 +1526,20 @@ export const workspaces = sqliteTable('workspaces', {
     // column, so existing workspaces keep that until switched off. Read by `maybeStartAutoFix`
     // (coding/ai-fix/auto-fix.ts); the ONE writer is `setWorkspaceAutoReview`. It only matters
     // while auto review is on.
-    autoFixEnabled: integer('auto_fix_enabled', { mode: 'boolean' }).notNull().default(true),
+    autoFixEnabled: integer('auto_fix_enabled', { mode: 'boolean' }).notNull().default(false),
+    // AUTO REVIEW DAILY CAP (migration 0085 / pg 0072): auto runs this workspace may start per UTC
+    // day. OVERRIDES ONLY — NULL = the default `AUTO_REVIEW_DAILY_CAP` (20), resolved through
+    // `resolveAutoReviewDailyCap`; the route bounds it 1..500. The ONE writer is
+    // `setWorkspaceAutoReview`, the reader the sweeper's roster (`listAutoReviewWorkspaces`).
+    autoReviewDailyCap: integer('auto_review_daily_cap'),
+    // AUTO-POSTING (migration 0087 / pg 0074): may a SUCCEEDED AUTO review (and an auto ticket
+    // review) post its output to GitHub without a click? NULL/false = OFF — the default for every
+    // workspace, existing and new; nullable with no default, so no workspace insert has to name it.
+    // `autoPostSettings` is OVERRIDES ONLY ({ scope?, kinds? }) — NULL = the product defaults,
+    // resolved through `resolveAutoPostSettings` (review/claude-review/auto-settings.ts). The ONE
+    // writer is `setWorkspaceAutoReview`; the reader is review/claude-review/auto-post.ts.
+    autoPostEnabled: integer('auto_post_enabled', { mode: 'boolean' }),
+    autoPostSettings: text('auto_post_settings', { mode: 'json' }).$type(),
     createdAt: integer('created_at', { mode: 'timestamp' })
         .notNull()
         .default(sql `(unixepoch())`),

package/dist/db/ticket-review-prune.js

@@ -6,7 +6,9 @@ import { schema } from './client.js';
 //   • a run left with NO members is deleted with its items — it describes nothing any more. That
 //     includes a run refused before it had members, which only its starting PR anchors;
 //   • an item whose owner was a deleted PR keeps its history but loses the owner (`owner_pr_id`
-//     null), so a Post can never target a PR that is gone.
+//     null), so a Post can never target a PR that is gone;
+//   • the deleted PRs' contribution cards (`ticket_review_pr_cards`, migration 0086 / pg 0073) go
+//     with them — a card describes one PR's head and nothing else.
 // Children before parents, explicitly — the composite FKs cascade, but these paths run parent-last
 // by hand on both dialects. Runs inside the caller's transaction.
 export async function pruneTicketReviewsForPrs(tx, prIds) {
@@ -29,6 +31,7 @@ export async function pruneTicketReviewsForPrs(tx, prIds) {
         .where(inArray(tr.originPrId, ids))
         .execute());
     await tx.delete(m).where(inArray(m.prId, ids)).execute();
+    await tx.delete(schema.ticketReviewPrCards).where(inArray(schema.ticketReviewPrCards.prId, ids)).execute();
     await tx.update(items).set({ ownerPrId: null }).where(inArray(items.ownerPrId, ids)).execute();
     const runIds = [...new Set([...touched, ...started].map((r) => r.id))];
     if (runIds.length === 0)