agentevo-cloud 0.1.0__tar.gz → 0.1.2__tar.gz

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentevo-cloud
-Version: 0.1.0
+Version: 0.1.2
 Summary: Agentevo SaaS (TZ-3 control plane, TZ-4 managed intelligence): auth, metering, C2 APIs, workers.
 Project-URL: Homepage, https://agentevo.sh
 Author: Agentevo

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentevo-cloud"
-version = "0.1.0"
+version = "0.1.2"
 description = "Agentevo SaaS (TZ-3 control plane, TZ-4 managed intelligence): auth, metering, C2 APIs, workers."
 readme = "README.md"
 requires-python = ">=3.12"

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/src/agentevo_cloud/app.py

@@ -10,7 +10,7 @@ response; metering increments in the request transaction.
 from __future__ import annotations
 
 import sqlite3
-from collections.abc import Awaitable, Callable, Iterator
+from collections.abc import Awaitable, Callable, Iterator, MutableMapping
 from contextlib import suppress
 from dataclasses import replace
 from datetime import UTC, datetime, timedelta
@@ -148,6 +148,7 @@ def create_app(db: Database, settings: Settings) -> FastAPI:
     app.middleware("http")(_metering_middleware)
     app.middleware("http")(_commit_middleware)
     app.middleware("http")(_maintenance_middleware)
+    app.middleware("http")(_body_limit_middleware)
     app.get("/healthz")(_healthz)
     app.post("/v1/auth/tokens", status_code=201)(_issue_token)
     app.get("/v1/auth/tokens")(_list_tokens)
@@ -243,6 +244,15 @@ async def _http_handler(request: Request, exc: StarletteHTTPException) -> JSONRe
 #: Methods that keep serving while the control plane is in maintenance.
 _MAINTENANCE_SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
 
+#: Largest accepted request body (10 MiB). Sync/event batches are small by
+#: contract (<=100 items); anything larger is a client bug or a memory-DoS
+#: probe, rejected with 413 before parsing, metering, or the database run.
+MAX_REQUEST_BODY_BYTES = 10 * 1024 * 1024
+
+
+class _BodyTooLargeError(Exception):
+    """Internal signal: a streaming body exceeded the cap mid-read."""
+
 
 async def _maintenance_middleware(
     request: Request, call_next: Callable[[Request], Awaitable[Response]]
@@ -267,6 +277,48 @@ async def _maintenance_middleware(
     return await call_next(request)
 
 
+async def _body_limit_middleware(
+    request: Request, call_next: Callable[[Request], Awaitable[Response]]
+) -> Response:
+    """Bound request-body memory before anything else runs.
+
+    Registered last so it runs outermost: declared over-cap bodies 413
+    without touching metering or the database, and undeclared (chunked)
+    bodies are counted while streaming with the same 413 past the cap.
+    """
+    declared = request.headers.get("content-length")
+    if declared is not None:
+        try:
+            if int(declared) > MAX_REQUEST_BODY_BYTES:
+                return _too_large_response()
+        except ValueError:
+            pass
+    inner_receive = request.receive
+    seen = 0
+
+    async def _counting_receive() -> MutableMapping[str, Any]:
+        nonlocal seen
+        message = await inner_receive()
+        seen += len(message.get("body", b""))
+        if seen > MAX_REQUEST_BODY_BYTES:
+            raise _BodyTooLargeError
+        return message
+
+    try:
+        return await call_next(Request(request.scope, _counting_receive))
+    except _BodyTooLargeError:
+        return _too_large_response()
+
+
+def _too_large_response() -> JSONResponse:
+    exc = AgentevoError(
+        ErrorCode.PAYLOAD_TOO_LARGE,
+        f"request body exceeds {MAX_REQUEST_BODY_BYTES} bytes",
+        {"limit_bytes": MAX_REQUEST_BODY_BYTES},
+    )
+    return _error_response(exc.code, exc.message, exc.details, exc)
+
+
 async def _metering_middleware(
     request: Request, call_next: Callable[[Request], Awaitable[Response]]
 ) -> Response:

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/src/agentevo_cloud/db.py

@@ -10,11 +10,23 @@ from __future__ import annotations
 
 import os
 import sqlite3
+import threading
+import time
 from collections.abc import Callable, Iterator
 from contextlib import contextmanager, suppress
 from pathlib import Path
 
-SCHEMA_VERSION = 8
+SCHEMA_VERSION = 9
+
+#: Migration mutual exclusion. Five compose services share one SQLite file
+#: and migrate lazily on first use; without this, concurrent first-boots race
+#: the unguarded ALTERs (observed: duplicate column on production boot).
+#: In-process via a thread lock, cross-process via an O_EXCL sidecar file
+#: (portable: no fcntl, Windows-safe). Stale locks (crashed holder) break
+#: after a minute; migrates take milliseconds, so waiting is the common case.
+_MIGRATE_LOCK_TIMEOUT_SECONDS = 90.0
+_MIGRATE_LOCK_STALE_SECONDS = 60.0
+_MIGRATE_LOCK_POLL_SECONDS = 0.05
 
 _SCHEMA_V1 = """
 CREATE TABLE IF NOT EXISTS meta (
@@ -346,6 +358,10 @@ def _ensure_job_durability_columns(raw: sqlite3.Connection) -> None:
 
 _MIGRATION_FOLLOWUPS[8] = _ensure_job_durability_columns
 
+_SCHEMA_V9 = """
+CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_links_repo ON repo_links (repo);
+"""
+
 MIGRATIONS: tuple[tuple[int, str], ...] = (
     (1, _SCHEMA_V1),
     (2, _SCHEMA_V2),
@@ -355,6 +371,7 @@ MIGRATIONS: tuple[tuple[int, str], ...] = (
     (6, _SCHEMA_V6),
     (7, _SCHEMA_V7),
     (8, _SCHEMA_V8),
+    (9, _SCHEMA_V9),
 )
 
 
@@ -365,6 +382,7 @@ class Database:
         """Bind a database file path (created + migrated on first use)."""
         self._path = str(path)
         self._migrated = False
+        self._lock = threading.Lock()
 
     @property
     def path(self) -> str:
@@ -372,8 +390,20 @@ class Database:
         return self._path
 
     def migrate(self) -> int:
-        """Apply pending migrations; returns the schema version."""
-        _secure_file(self._path)
+        """Apply pending migrations; returns the schema version.
+
+        Serialized in-process and cross-process: concurrent first-boots of
+        several services sharing one file must not interleave schema writes.
+        """
+        with self._lock:
+            _secure_file(self._path)
+            if self._path == ":memory:":
+                return self._migrate_unsafe()
+            with _migrate_file_lock(self._path):
+                return self._migrate_unsafe()
+
+    def _migrate_unsafe(self) -> int:
+        """Run pending migrations; caller holds the migration locks."""
         raw = sqlite3.connect(self._path, timeout=30.0)
         try:
             raw.execute("PRAGMA journal_mode=WAL")
@@ -427,6 +457,50 @@ def _secure_file(path: str) -> None:
         os.chmod(path, 0o600)
 
 
+@contextmanager
+def _migrate_file_lock(path: str, timeout: float = _MIGRATE_LOCK_TIMEOUT_SECONDS) -> Iterator[None]:
+    """Hold an exclusive cross-process migration lock for ``path``.
+
+    Atomic ``O_EXCL`` create, so exactly one first-boot wins; losers poll
+    until the winner finishes (milliseconds) or break the lock when its
+    mtime proves the holder crashed. Raises ``TimeoutError`` past ``timeout``
+    instead of wedging a boot forever.
+    """
+    lock = f"{path}.migrate.lock"
+    deadline = time.monotonic() + timeout
+    while True:
+        try:
+            fd = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+        except FileExistsError:
+            if _migrate_lock_is_stale(lock):
+                with suppress(OSError):
+                    os.unlink(lock)
+                continue
+            if time.monotonic() >= deadline:
+                raise TimeoutError(f"timed out waiting for migration lock: {lock}") from None
+            time.sleep(_MIGRATE_LOCK_POLL_SECONDS)
+            continue
+        try:
+            os.write(fd, str(os.getpid()).encode("ascii"))
+        finally:
+            os.close(fd)
+        break
+    try:
+        yield
+    finally:
+        with suppress(FileNotFoundError):
+            os.unlink(lock)
+
+
+def _migrate_lock_is_stale(lock: str) -> bool:
+    """True when ``lock`` outlived any plausible migrate (crashed holder)."""
+    try:
+        age = time.time() - os.path.getmtime(lock)
+    except OSError:
+        return True  # Vanished mid-check: safe to break and retry.
+    return age > _MIGRATE_LOCK_STALE_SECONDS
+
+
 def _current_version(conn: sqlite3.Connection) -> int:
     table = conn.execute(
         "SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'meta'"

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/src/agentevo_cloud/devices.py

@@ -447,7 +447,12 @@ def exchange_ci_token(
 
 
 def link_repo(conn: sqlite3.Connection, tenant_id: str, repo: str, workspace_slug: str) -> RepoLink:
-    """Bind a CI repository to one tenant workspace (owner/name form)."""
+    """Bind a CI repository to one tenant workspace (owner/name form).
+
+    Repos are globally unique: owner/name identifies one upstream repository,
+    so a second tenant linking the same name conflicts instead of shadowing
+    the CI exchange resolution.
+    """
     if get_tenant(conn, tenant_id) is None:
         raise AgentevoError(
             ErrorCode.NOT_FOUND, f"unknown tenant: {tenant_id}", {"tenant_id": tenant_id}
@@ -464,11 +469,18 @@ def link_repo(conn: sqlite3.Connection, tenant_id: str, repo: str, workspace_slu
             f"unknown workspace: {workspace_slug}",
             {"workspace": workspace_slug},
         )
-    conn.execute(
-        "INSERT INTO repo_links (tenant_id, repo, workspace_slug) VALUES (?, ?, ?)"
-        " ON CONFLICT (tenant_id, repo) DO UPDATE SET workspace_slug = excluded.workspace_slug",
-        (tenant_id, repo, workspace_slug),
-    )
+    try:
+        conn.execute(
+            "INSERT INTO repo_links (tenant_id, repo, workspace_slug) VALUES (?, ?, ?)"
+            " ON CONFLICT (tenant_id, repo) DO UPDATE SET workspace_slug = excluded.workspace_slug",
+            (tenant_id, repo, workspace_slug),
+        )
+    except sqlite3.IntegrityError as exc:
+        raise AgentevoError(
+            ErrorCode.CONFLICT,
+            "repository is already linked",
+            {"repository": repo},
+        ) from exc
     return RepoLink(tenant_id=tenant_id, repo=repo, workspace_slug=workspace_slug)
 
 

agentevo_cloud-0.1.2/tests/test_body_limit.py

@@ -0,0 +1,103 @@
+"""Request body cap: oversized bodies 413 before parsing/metering (F1)."""
+
+import asyncio
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+import pytest
+from fastapi.testclient import TestClient
+from starlette.requests import Request
+from starlette.responses import JSONResponse, Response
+
+from agentevo_cloud.app import MAX_REQUEST_BODY_BYTES, _body_limit_middleware, create_app
+from agentevo_cloud.cli import provision
+from agentevo_cloud.config import Settings
+from agentevo_cloud.db import Database
+
+STAMP = datetime(2026, 9, 21, 12, 0, 0, tzinfo=UTC)
+
+
+@pytest.fixture
+def client(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Any:
+    monkeypatch.setenv("AGENTEVO_DB_PATH", str(tmp_path / "bodylimit.db"))
+    monkeypatch.setenv("AGENTEVO_RATE_LIMIT", "1000000")
+    settings = Settings()
+    db = Database(settings.db_path)
+    seeded = provision(
+        db, tenant_id="t-1", name="Acme", user_id="u-1", workspace_slug="demo", now=STAMP
+    )
+    handle = TestClient(create_app(db, settings))
+    handle.provisioned = seeded  # type: ignore[attr-defined]
+    handle.db = db  # type: ignore[attr-defined]
+    return handle
+
+
+def auth(secret: str) -> dict[str, str]:
+    return {"Authorization": f"Bearer {secret}"}
+
+
+def test_declared_over_cap_413_unmetered(client: Any) -> None:
+    secret = client.provisioned["secret"]
+    used_before = client.get("/v1/usage", headers=auth(secret)).json()["used"]
+    big = "x" * (MAX_REQUEST_BODY_BYTES + 1)
+    response = client.post("/v1/recall", headers=auth(secret), json={"text": big})
+    assert response.status_code == 413
+    body = response.json()
+    assert body["code"] == "PAYLOAD_TOO_LARGE"
+    assert body["details"] == {"limit_bytes": MAX_REQUEST_BODY_BYTES}
+    assert "x" * 100 not in response.text
+    used_after = client.get("/v1/usage", headers=auth(secret)).json()["used"]
+    assert used_after == used_before
+
+
+def test_exactly_at_cap_passes(client: Any) -> None:
+    secret = client.provisioned["secret"]
+    pad = MAX_REQUEST_BODY_BYTES - len('{"text": ""}')
+    response = client.post("/v1/recall", headers=auth(secret), json={"text": "x" * pad})
+    assert response.status_code == 200
+
+
+def _run_middleware(scope: dict[str, Any], messages: list[dict[str, Any]]) -> Response:
+    queue = list(messages)
+
+    async def _receive() -> dict[str, Any]:
+        return queue.pop(0)
+
+    async def _call_next(request: Request) -> Response:
+        body = b""
+        while True:
+            message = await request.receive()
+            body += message.get("body", b"")
+            if not message.get("more_body", False):
+                break
+        return JSONResponse({"received": len(body)})
+
+    return asyncio.run(_body_limit_middleware(Request(scope, _receive), _call_next))
+
+
+def _scope(headers: list[tuple[bytes, bytes]]) -> dict[str, Any]:
+    return {"type": "http", "method": "POST", "path": "/", "headers": headers}
+
+
+def test_invalid_content_length_falls_through_to_stream_count() -> None:
+    scope = _scope([(b"content-length", b"bogus")])
+    response = _run_middleware(scope, [{"type": "http.request", "body": b"{}", "more_body": False}])
+    assert response.status_code == 200
+
+
+def test_chunked_over_cap_413() -> None:
+    chunk = b"y" * (MAX_REQUEST_BODY_BYTES // 2 + 1)
+    messages = [
+        {"type": "http.request", "body": chunk, "more_body": True},
+        {"type": "http.request", "body": chunk, "more_body": False},
+    ]
+    response = _run_middleware(_scope([]), messages)
+    assert response.status_code == 413
+
+
+def test_chunked_under_cap_passes() -> None:
+    response = _run_middleware(
+        _scope([]), [{"type": "http.request", "body": b"{}", "more_body": False}]
+    )
+    assert response.status_code == 200

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/tests/test_devices_ci.py

@@ -729,6 +729,18 @@ def test_repo_link_lifecycle(conn: sqlite3.Connection) -> None:
     assert exc_info.value.code is ErrorCode.NOT_FOUND
 
 
+def test_repo_link_rejects_second_tenant(conn: sqlite3.Connection) -> None:
+    create_tenant(conn, "t-2", "Rival", now=STAMP)
+    create_workspace(conn, "t-2", "demo", "Demo", now=STAMP)
+    link_repo(conn, "t-1", "acme/app", "demo")
+    with pytest.raises(AgentevoError) as exc_info:
+        link_repo(conn, "t-2", "acme/app", "demo")
+    assert exc_info.value.code is ErrorCode.CONFLICT
+    assert exc_info.value.details == {"repository": "acme/app"}
+    found = find_repo(conn, "acme/app")
+    assert found is not None and found.tenant_id == "t-1"
+
+
 def test_repo_link_validates_input(conn: sqlite3.Connection) -> None:
     with pytest.raises(AgentevoError) as exc_info:
         link_repo(conn, "t-9", "acme/app", "demo")

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/tests/test_foundation.py

@@ -2,12 +2,15 @@
 
 import os
 import sqlite3
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
 
 import pytest
 
-from agentevo_cloud.db import MIGRATIONS, SCHEMA_VERSION, Database
+from agentevo_cloud.db import MIGRATIONS, SCHEMA_VERSION, Database, _migrate_file_lock
 from agentevo_cloud.tenants import (
     FREE_MONTHLY_QUOTA,
     add_membership,
@@ -54,6 +57,85 @@ def test_migrate_is_idempotent(db: Database) -> None:
     assert db.path.endswith("cloud.db")
 
 
+def test_concurrent_migrate_single_file_is_clean(tmp_path: Path) -> None:
+    """Eight racers, one file: every migrate lands on SCHEMA_VERSION.
+
+    Regression: five compose services migrating one fresh SQLite file raced
+    the unguarded V2 ALTERs (duplicate column) on first boot.
+    """
+    path = tmp_path / "race.db"
+
+    def worker(_: int) -> int:
+        return Database(path).migrate()
+
+    with ThreadPoolExecutor(max_workers=8) as pool:
+        assert list(pool.map(worker, range(8))) == [SCHEMA_VERSION] * 8
+    assert Database(path).migrate() == SCHEMA_VERSION
+
+
+def test_migrate_breaks_stale_lock(tmp_path: Path) -> None:
+    """A lock file from a crashed migrator does not wedge future boots."""
+    path = tmp_path / "stale.db"
+    lock = tmp_path / "stale.db.migrate.lock"
+    lock.write_text("dead-pid", encoding="utf-8")
+    ancient = 1_000_000_000.0
+    os.utime(lock, (ancient, ancient))
+    assert Database(path).migrate() == SCHEMA_VERSION
+    assert not lock.exists()
+
+
+def test_migrate_file_lock_waits_then_acquires(tmp_path: Path) -> None:
+    """A held (fresh) lock blocks until release, then migration proceeds."""
+    path = str(tmp_path / "wait.db")
+    lock = tmp_path / "wait.db.migrate.lock"
+    lock.write_text("holder", encoding="utf-8")
+    acquired: list[bool] = []
+
+    def worker() -> None:
+        with _migrate_file_lock(path, timeout=10.0):
+            acquired.append(True)
+
+    thread = threading.Thread(target=worker)
+    thread.start()
+    time.sleep(0.2)
+    assert acquired == []
+    lock.unlink()
+    thread.join(timeout=10.0)
+    assert acquired == [True]
+
+
+def test_migrate_file_lock_times_out(tmp_path: Path) -> None:
+    """A held lock past the deadline raises instead of hanging a boot."""
+    path = str(tmp_path / "busy.db")
+    (tmp_path / "busy.db.migrate.lock").write_text("holder", encoding="utf-8")
+    with (
+        pytest.raises(TimeoutError, match="migration lock"),
+        _migrate_file_lock(path, timeout=0.0),
+    ):
+        pass  # acquire must raise first
+
+
+def test_migrate_lock_tolerates_vanishing_lock(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A lock deleted between contention and mtime check retries cleanly."""
+    path = str(tmp_path / "gone.db")
+    (tmp_path / "gone.db.migrate.lock").write_text("holder", encoding="utf-8")
+    real_getmtime = os.path.getmtime
+    calls = []
+
+    def flaky_getmtime(target: str) -> float:
+        calls.append(target)
+        if len(calls) == 1:
+            raise OSError("vanished")
+        return real_getmtime(target)
+
+    monkeypatch.setattr(os.path, "getmtime", flaky_getmtime)
+    with _migrate_file_lock(path, timeout=5.0):
+        pass
+    assert len(calls) == 1
+
+
 def test_database_file_is_owner_only(tmp_path: Path) -> None:
     path = tmp_path / "cloud.db"
     assert Database(path).migrate() == SCHEMA_VERSION
@@ -68,7 +150,7 @@ def test_database_memory_skips_file_lockdown() -> None:
 
 
 def test_v6_jobs_table_and_verification_column(db: Database) -> None:
-    assert db.migrate() == 8
+    assert db.migrate() == 9
     with db.connect() as conn:
         conn.execute(
             "INSERT INTO jobs (tenant_id, job_id, job_type, object_id, version,"
@@ -88,16 +170,16 @@ def test_v6_jobs_table_and_verification_column(db: Database) -> None:
 
 def test_v6_replay_with_objects_present_is_clean(tmp_path: Path) -> None:
     path = tmp_path / "replay.db"
-    assert Database(path).migrate() == 8
+    assert Database(path).migrate() == 9
     raw = sqlite3.connect(str(path))
     raw.execute("UPDATE meta SET value = '5' WHERE key = 'schema_version'")
     raw.commit()
     raw.close()
-    assert Database(path).migrate() == 8  # Guarded ALTERs survive replays.
+    assert Database(path).migrate() == 9  # Guarded ALTERs survive replays.
 
 
 def test_v7_sync_mode_columns_default_local_only(db: Database) -> None:
-    assert db.migrate() == 8
+    assert db.migrate() == 9
     with db.connect() as conn:
         columns = {
             item["name"] for item in conn.execute("PRAGMA table_info(workspaces)").fetchall()
@@ -121,7 +203,7 @@ def test_v7_sync_mode_columns_default_local_only(db: Database) -> None:
 
 def test_v7_replay_with_mode_set_is_clean(tmp_path: Path) -> None:
     path = tmp_path / "replay7.db"
-    assert Database(path).migrate() == 8
+    assert Database(path).migrate() == 9
     raw = sqlite3.connect(str(path))
     raw.execute(
         "INSERT INTO tenants (id, name, plan, created_at) VALUES ('t-1', 'Acme', 'free', ?)",
@@ -136,7 +218,7 @@ def test_v7_replay_with_mode_set_is_clean(tmp_path: Path) -> None:
     raw.execute("UPDATE meta SET value = '6' WHERE key = 'schema_version'")
     raw.commit()
     raw.close()
-    assert Database(path).migrate() == 8  # Followup skips existing columns.
+    assert Database(path).migrate() == 9  # Followup skips existing columns.
     check = sqlite3.connect(str(path))
     try:
         row = check.execute("SELECT sync_mode FROM workspaces").fetchone()
@@ -146,7 +228,7 @@ def test_v7_replay_with_mode_set_is_clean(tmp_path: Path) -> None:
 
 
 def test_v8_job_durability_columns_default_zero(db: Database) -> None:
-    assert db.migrate() == 8
+    assert db.migrate() == 9
     with db.connect() as conn:
         columns = {item["name"] for item in conn.execute("PRAGMA table_info(jobs)").fetchall()}
         assert {"attempts", "lease_expires_at", "next_run_at"} <= columns
@@ -165,7 +247,7 @@ def test_v8_job_durability_columns_default_zero(db: Database) -> None:
 
 def test_v8_replay_with_attempts_set_is_clean(tmp_path: Path) -> None:
     path = tmp_path / "replay8.db"
-    assert Database(path).migrate() == 8
+    assert Database(path).migrate() == 9
     raw = sqlite3.connect(str(path))
     raw.execute(
         "INSERT INTO jobs (tenant_id, job_id, job_type, object_id, version,"
@@ -176,7 +258,7 @@ def test_v8_replay_with_attempts_set_is_clean(tmp_path: Path) -> None:
     raw.execute("UPDATE meta SET value = '7' WHERE key = 'schema_version'")
     raw.commit()
     raw.close()
-    assert Database(path).migrate() == 8  # Followup skips existing columns.
+    assert Database(path).migrate() == 9  # Followup skips existing columns.
     check = sqlite3.connect(str(path))
     try:
         row = check.execute("SELECT attempts FROM jobs").fetchone()

{agentevo_cloud-0.1.0 → agentevo_cloud-0.1.2}/tests/test_managed.py

@@ -223,7 +223,7 @@ def test_v5_backfill_indexes_preexisting_deltas(tmp_path: Path) -> None:
     raw.execute("UPDATE meta SET value = '4' WHERE key = 'schema_version'")
     raw.commit()
     raw.close()
-    assert Database(path).migrate() == 8
+    assert Database(path).migrate() == 9
     with Database(path).connect() as conn:
         kept = get_managed(conn, "t-1", "skill:kept", 1)
         assert kept is not None and kept.state == "Candidate"
@@ -234,4 +234,4 @@ def test_v5_backfill_indexes_preexisting_deltas(tmp_path: Path) -> None:
         ).fetchone()
         assert gone is not None and gone["state"] == "Revoked"
         assert get_managed(conn, "t-1", "skill:sealed", 1) is None
-    assert Database(path).migrate() == 8  # Backfill reruns are no-ops.
+    assert Database(path).migrate() == 9  # Backfill reruns are no-ops.