pinecall-runtime 0.1.6__py3-none-any.whl

pinecall/postgres/migrations/0060_drift.sql

@@ -0,0 +1,62 @@
+-- Drift: each day's stage latencies and judges' verdicts, by agent and by the config version a
+-- call ran on, folded once when the call is sealed (log/drift.py), so /v1/insights and
+-- /v1/insights/drift read a few rows instead of a day of the log.
+--
+-- stage_days keeps a stage's seconds as a fixed histogram (log/_histogram.py: 94 buckets, each 10 %
+-- wider than the last): two calls' histograms add bucket by bucket, and a median or p95 read off
+-- one is within 5 %. judge_days counts each judge's settled verdicts under the hash of the
+-- question it asked. config_version 0 is a call that ran on no version of its scope's settings;
+-- vendor and model '' are a turn whose report named none, as the PRIMARY KEY cannot hold a null.
+-- drift_calls is one row per call folded: it keeps the fold from counting a call twice, and holds
+-- the verdicts it counted, so a call judged again replaces them rather than adding.
+--
+-- Three new tables: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for
+-- each foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+
+CREATE TABLE stage_days (
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    env text NOT NULL CHECK (env IN ('production', 'sandbox')),
+    holder text NOT NULL,
+    agent text NOT NULL,
+    day date NOT NULL,
+    config_version integer NOT NULL,
+    stage text NOT NULL CHECK (stage IN ('stt', 'llm', 'tts')),
+    vendor text NOT NULL,
+    model text NOT NULL,
+    turns integer NOT NULL,
+    buckets integer[] NOT NULL,
+    confidence_sum double precision NOT NULL,
+    confidence_turns integer NOT NULL,
+    PRIMARY KEY (org, env, holder, day, agent, config_version, stage, vendor, model)
+);
+
+CREATE TABLE judge_days (
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    env text NOT NULL CHECK (env IN ('production', 'sandbox')),
+    holder text NOT NULL,
+    agent text NOT NULL,
+    day date NOT NULL,
+    config_version integer NOT NULL,
+    judge text NOT NULL,
+    criteria text NOT NULL,
+    held integer NOT NULL,
+    broken integer NOT NULL,
+    PRIMARY KEY (org, env, holder, day, agent, config_version, judge, criteria)
+);
+
+-- A version's rows across its days, for a drift between two versions.
+CREATE INDEX stage_days_by_version ON stage_days (org, env, holder, agent, config_version);
+CREATE INDEX judge_days_by_version ON judge_days (org, env, holder, agent, config_version);
+
+CREATE TABLE drift_calls (
+    call text PRIMARY KEY,
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    env text NOT NULL,
+    holder text NOT NULL,
+    agent text NOT NULL,
+    day date NOT NULL,
+    config_version integer NOT NULL,
+    verdicts jsonb NOT NULL
+);
+
+CREATE INDEX drift_calls_by_day ON drift_calls (org, day);

pinecall/postgres/migrations/0061_canaries.sql

@@ -0,0 +1,24 @@
+-- A version of an agent's settings on a share of its calls (tenancy/canary.py): the newest row of
+-- a scope says which version takes `share` % of the scope's calls, each call picked once by its
+-- id; every other call runs what the scope would run without that version. A row with no version
+-- is the canary cleared. Rows are only ever added, so the canary that stood when a call opened is
+-- read back for it (GET /v1/calls/{call}/settings says whether the call was one).
+--
+-- A new table: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for the
+-- foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+
+CREATE TABLE agent_canaries (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    env text NOT NULL CHECK (env IN ('production', 'sandbox')),
+    holder text NOT NULL,
+    agent text NOT NULL,
+    version integer CHECK (version > 0),
+    share integer CHECK (share BETWEEN 0 AND 100),
+    author text NOT NULL,
+    note text,
+    set_at timestamptz NOT NULL DEFAULT now(),
+    CHECK ((version IS NULL) = (share IS NULL))
+);
+
+CREATE INDEX agent_canaries_standing ON agent_canaries (org, env, holder, agent, set_at DESC, id DESC);

pinecall/postgres/migrations/0062_eval_cases.sql

@@ -0,0 +1,23 @@
+-- The org's dataset: a real call's caller turns kept as a golden an eval run can play again
+-- (evals/dataset.py). A case is tenant data like the call it came from: erasing that call, the
+-- contact who made it, or the org erases the case too (tenancy/erasure.py by `source_call`, the
+-- foreign key for the org), and the calls retention erases go through the same path.
+--
+-- A new table: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for the
+-- foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+
+CREATE TABLE eval_cases (
+    id text PRIMARY KEY,
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    agent text NOT NULL,
+    name text NOT NULL,
+    golden jsonb NOT NULL,
+    source_call text NOT NULL,
+    source_env text NOT NULL CHECK (source_env IN ('production', 'sandbox')),
+    held_out boolean NOT NULL DEFAULT false,
+    author text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (org, agent, name)
+);
+
+CREATE INDEX eval_cases_by_call ON eval_cases (source_call);

pinecall/postgres/migrations/0063_prompts.sql

@@ -0,0 +1,16 @@
+-- Each distinct block of prompt an org's calls were told, kept once under the hash the log's
+-- prompt.changed names (tenancy/prompts.py), so a call of thirty days ago has its exact prompt:
+-- the knowledge its settings placed, and every block its app set. Written the first time a
+-- gateway process meets a text (a call opening with its knowledge, an app's prompt.set), never
+-- once per call. Tenant data: the org's foreign key takes it with the org.
+--
+-- A new table: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for the
+-- foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+
+CREATE TABLE prompts (
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    hash text NOT NULL,
+    text text NOT NULL,
+    first_used_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (org, hash)
+);

pinecall/postgres/migrations/0075_call_private.sql

@@ -0,0 +1,14 @@
+-- What is private is sealed when written. An entry whose agent declared some of its values
+-- private (a tool's `pii` arguments, a state field declared `pii`) is kept in call_log with
+-- those values masked, and the values themselves are kept here, sealed under PINECALL_VAULT_KEY,
+-- one row per entry, keyed by the entry's log and seq (log/private.py). They are read only where
+-- a call is taken up: an app taking it over, a written call after a restart. `vault rotate`
+-- re-seals the column; an erasure deletes the rows of the logs it erases (tenancy/erasure.py).
+-- A new table with no foreign key: CREATE TABLE takes no lock on any table that exists, so
+-- appends and reads go on while it runs.
+CREATE TABLE call_private (
+    log text NOT NULL,
+    seq bigint NOT NULL,
+    sealed text NOT NULL,
+    PRIMARY KEY (log, seq)
+);

pinecall/postgres/migrations/0076_recording_keys.sql

@@ -0,0 +1,13 @@
+-- A recording is sealed where it is kept: the worker seals the file under a key of the call's own
+-- before it stores it on the disk or in the bucket, and the gateway opens a player's range with
+-- it (process/sealed_audio.py). The key is kept here, sealed under PINECALL_VAULT_KEY, one row per
+-- call, made the first time the call's worker asks (tenancy/recording_keys.py); `vault rotate`
+-- re-seals it, and an erasure deletes it with the call, so a copy of the file that outlives the
+-- erasure (a night's backup) no longer opens. A recording stored before this is plain, and named so.
+-- A new table with no foreign key: CREATE TABLE takes no lock on any table that exists.
+CREATE TABLE recording_keys (
+    call text PRIMARY KEY,
+    org text NOT NULL,
+    sealed text NOT NULL,
+    made_at timestamptz NOT NULL DEFAULT now()
+);

pinecall/postgres/migrations/0077_tokens_world.sql

@@ -0,0 +1,7 @@
+-- A web call is opened only where its token was minted: the org, the agent and now the world.
+-- The world a room token was minted in is kept with it, and the open compares it with the world
+-- the worker names (tenancy/tokens.py spend). A token minted before this has none, and is held to
+-- its org and agent alone; it expires within minutes of its mint in any case.
+-- ADD COLUMN with no default and no NOT NULL changes the catalog alone: ACCESS EXCLUSIVE on tokens
+-- for the instant of the statement, no rewrite; a mint or an open waits that instant.
+ALTER TABLE tokens ADD COLUMN env text;

pinecall/postgres/migrations/0078_facts_cost_by_stage.sql

@@ -0,0 +1,12 @@
+-- A call's cost by stage: what its model, ears, voice, phone legs and the box's own compute came
+-- to, folded from the summary's rows beside cost_usd (log/facts.py), so a day's insights say which
+-- stage an agent spends on without reading a summary. A call folded before this is filled in by
+-- `pinecall-runtime facts rebuild`.
+-- ADD COLUMN with no default and no NOT NULL changes the catalog alone: ACCESS EXCLUSIVE on
+-- call_facts for the instant of the statement, no rewrite; a fold waits that instant.
+ALTER TABLE call_facts
+    ADD COLUMN cost_llm_usd double precision,
+    ADD COLUMN cost_stt_usd double precision,
+    ADD COLUMN cost_tts_usd double precision,
+    ADD COLUMN cost_phone_usd double precision,
+    ADD COLUMN cost_platform_usd double precision;

pinecall/postgres/migrations/0079_judge_labels.sql

@@ -0,0 +1,20 @@
+-- What a person said a judge should have answered on a call (evals/calibration.py): one label per
+-- call and judge, replaced when labelled again. Each judge's agreement with them is read against
+-- the verdict the seal counted (drift_calls), so a judge that disagrees with the people who know
+-- is reported, never trusted silently. A label goes with its call's erasure and with the org.
+-- A new table: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for the
+-- foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+CREATE TABLE judge_labels (
+    call text NOT NULL,
+    judge text NOT NULL,
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    env text NOT NULL CHECK (env IN ('production', 'sandbox')),
+    agent text NOT NULL,
+    held boolean NOT NULL,
+    note text,
+    author text NOT NULL,
+    labelled_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (call, judge)
+);
+
+CREATE INDEX judge_labels_by_org ON judge_labels (org, env, agent);

pinecall/postgres/migrations/0080_call_openings.sql

@@ -0,0 +1,20 @@
+-- What a call is, kept when it opens (log/openings.py): its context and the tuned config it runs
+-- on, so a gateway that did not open it serves its doors from one read instead of from the
+-- worker saying the call again. A config is kept once per org under the hash of its JSON: most
+-- calls of an agent run on a handful. An opening goes with its call's erasure; both with the org.
+-- New tables: CREATE TABLE locks nothing that exists but `orgs`, in SHARE ROW EXCLUSIVE for each
+-- foreign key, for the instant of the statement: reads of orgs go on, a write to it waits.
+CREATE TABLE call_configs (
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    hash text NOT NULL,
+    config jsonb NOT NULL,
+    PRIMARY KEY (org, hash)
+);
+
+CREATE TABLE call_openings (
+    call text PRIMARY KEY,
+    org text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+    context jsonb NOT NULL,
+    config_hash text NOT NULL,
+    opened_at timestamptz NOT NULL DEFAULT now()
+);

pinecall/postgres/migrations/0081_seal_lease.sql

@@ -0,0 +1,7 @@
+-- The seal's lease: a call is sealed by one gateway, whichever the worker's seal reached first.
+-- The gateway that takes the lease (log/store.py `lease_seal`) prices, remembers, judges and seals;
+-- one that finds it taken waits for the head to say sealed. A lease runs out on its own, so a
+-- gateway that died mid-seal leaves the call to the next knock.
+-- ADD COLUMN with no default and no NOT NULL changes the catalog alone: ACCESS EXCLUSIVE on
+-- call_log_head for the instant of the statement, no rewrite; an append waits that instant.
+ALTER TABLE call_log_head ADD COLUMN sealing_until timestamptz;

pinecall/postgres/migrations/0082_caller_codes.sql

@@ -0,0 +1,14 @@
+-- The four-digit codes a caller keys to tie their call to a page (tenancy/codes.py), kept here so
+-- any gateway issues, claims and answers them: before, each gateway held its own in memory and a
+-- code issued on one was unknown to another. The agent's log keeps code.issued and code.claimed
+-- as the record; this table is what is live. A code is claimed by one call, in one statement.
+-- A new table: CREATE TABLE locks nothing that exists.
+CREATE TABLE caller_codes (
+    agent text NOT NULL,
+    code text NOT NULL,
+    env text NOT NULL CHECK (env IN ('production', 'sandbox')),
+    log text NOT NULL CHECK (log IN ('public', 'tenant')),
+    expires_at double precision NOT NULL,
+    claimed text,
+    PRIMARY KEY (agent, code)
+);

pinecall/postgres/migrations/0083_one_use_words.sql

@@ -0,0 +1,15 @@
+-- Words spent once, kept here so a word minted on one gateway is spent on any (tenancy/words.py):
+-- a sign-in code, a terminal waiting for a browser, a provider's handshake, a sign-up waiting for
+-- its six digits. Before, each gateway held its own in memory. A word is kept as its sha256 and
+-- its value sealed under the vault: a copy of this table opens nothing, and a pairing's key is
+-- never in the clear. Swept as words are minted.
+-- A new table: CREATE TABLE locks nothing that exists.
+CREATE TABLE one_use_words (
+    word_hash bytea PRIMARY KEY,
+    kind text NOT NULL,
+    sealed text NOT NULL,
+    expires_at double precision NOT NULL,
+    attempts integer NOT NULL DEFAULT 0
+);
+
+CREATE INDEX one_use_words_by_end ON one_use_words (expires_at);

pinecall/postgres/migrations/0084_knocks_and_run_leases.sql

@@ -0,0 +1,23 @@
+-- What must be counted or held across the gateways of a box, in the one place they share.
+--
+-- knocks: each time a name knocked at a sign-in door or asked for a voice sample
+-- (tenancy/knocks.py). Five knocks a minute must mean five, whichever gateway each lands on;
+-- these doors are rare, so a row and a lock each cost nothing that matters. Rows past the window
+-- are deleted as knocks come in.
+--
+-- run_leases: the eval run each agent is under (evals/runs.py). A run takes its agent's lease and
+-- renews it while it runs; a gateway that dies mid-run leaves a lease that runs out on its own.
+-- New tables: CREATE TABLE locks nothing that exists.
+CREATE TABLE knocks (
+    name text NOT NULL,
+    at double precision NOT NULL
+);
+
+CREATE INDEX knocks_by_name ON knocks (name, at);
+CREATE INDEX knocks_by_age ON knocks (at);
+
+CREATE TABLE run_leases (
+    agent text PRIMARY KEY,
+    run text NOT NULL,
+    until timestamptz NOT NULL
+);

pinecall/postgres/migrations/0085_seal_lease_holder.sql

@@ -0,0 +1,8 @@
+-- Who holds the seal's lease: the gateway process that took it (log/store.py `lease_seal`), so
+-- only it renews the lease while it seals, and only it gives the lease back after a seal that
+-- broke. The lease is short (seal.py LEASED_S) and renewed: a gateway that dies mid-seal lets the
+-- call go in seconds, and a knock waiting on it takes the seal over; a gateway that lost the race
+-- cannot keep the winner's lease alive by renewing it.
+-- ADD COLUMN with no default and no NOT NULL changes the catalog alone: ACCESS EXCLUSIVE on
+-- call_log_head for the instant of the statement, no rewrite; an append waits that instant.
+ALTER TABLE call_log_head ADD COLUMN sealing_by text;

pinecall/postgres/migrations/0086_route_origin.sql

@@ -0,0 +1,17 @@
+-- How a number's row was written, so the org and the operator can tell whom to ask when it stops
+-- ringing: bought by the box, imported from an account of the org, hooked by the org itself
+-- (pointed at the box from its own carrier), or typed by the box's operator.
+-- The default is the operator's: a release before this one writes rows only through
+-- POST /v1/ops/routes or an import, and an import written by it during the deploy reads `typed`
+-- until the org imports it again.
+ALTER TABLE routes ADD COLUMN origin text NOT NULL DEFAULT 'typed'
+    CHECK (origin IN ('bought', 'imported', 'hooked', 'typed'));
+
+-- The rows already written, from what each one kept: a row with no account, no networks and not
+-- bought was typed (every such row on the box predates the cutover of 2026-09-29).
+UPDATE routes SET origin = CASE
+    WHEN managed THEN 'bought'
+    WHEN account IS NOT NULL THEN 'imported'
+    WHEN cardinality(networks) > 0 THEN 'hooked'
+    ELSE 'typed'
+END;

pinecall/postgres/migrations/0087_carrier_networks.sql

@@ -0,0 +1,20 @@
+-- The networks an org asks 5060 to open to: its own PBX's, or a number it points at the box from a
+-- carrier the box does not know. Nothing is admitted until the box's operator approves it; the
+-- fence (channels/telephony/firewall.py) opens to the approved rows alone.
+CREATE TABLE carrier_networks (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    org text NOT NULL REFERENCES orgs (id) ON DELETE CASCADE,
+    -- What asked for it: a SIP peer's username, or the number hooked with networks of its own.
+    source text NOT NULL,
+    network cidr NOT NULL,
+    state text NOT NULL DEFAULT 'waiting' CHECK (state IN ('waiting', 'approved', 'refused')),
+    asked_at timestamptz NOT NULL DEFAULT now(),
+    decided_by text,
+    decided_at timestamptz,
+    UNIQUE (org, source, network)
+);
+CREATE INDEX carrier_networks_by_state ON carrier_networks (state, asked_at);
+
+-- A number the org points at the box from a carrier of the box's catalog (carriers.csv): the
+-- carrier's own networks fence it, whatever they are on the day of the call.
+ALTER TABLE routes ADD COLUMN via text;

pinecall/postgres/migrations/0088_route_last_call.sql

@@ -0,0 +1,3 @@
+-- When a call to the number last reached the box (the worker opened it): what tells a number that
+-- rings here from one the carrier never sent. Written at most once a minute per number.
+ALTER TABLE routes ADD COLUMN last_call_at timestamptz;

pinecall/postgres/migrations/0089_offers.sql

@@ -0,0 +1,21 @@
+-- A room with a caller and no worker yet, and the worker the gateway offered it to
+-- (gateway/dispatching/). LiveKit offers a job once and remembers nothing: a worker that declines
+-- it, or a dead one LiveKit still lists, leaves the caller in silence. The gateway keeps the room
+-- here from the moment a caller joins until a worker opens its call (the row is then deleted),
+-- offers it to a worker it chose, and offers it again to another when nobody opened it in time.
+-- Any gateway may sweep it: an offer is taken by the UPDATE that finds the count it read, so two
+-- gateways never offer one room twice.
+-- New table: CREATE TABLE locks nothing that exists.
+CREATE TABLE offers (
+    room text PRIMARY KEY,
+    fleet text NOT NULL,
+    -- The call's dispatch, as the SIP rule or the visitor's token carried it into the room.
+    dispatch text NOT NULL,
+    seen_at double precision NOT NULL,
+    worker text,
+    offers integer NOT NULL DEFAULT 0,
+    offered_at double precision
+);
+
+CREATE INDEX offers_due ON offers (offered_at);
+CREATE INDEX offers_by_age ON offers (seen_at);

pinecall/postgres/migrations/0090_invitation_purpose.sql

@@ -0,0 +1,5 @@
+-- A link's purpose (tenancy/people.py): an invitation seats a person and never sets a password
+-- they already have; a reset is made to set it again. Until now one link did both, so a link
+-- handed out to seat somebody could set their one password in every org they belong to.
+-- New column with a default: nothing that exists stops reading.
+ALTER TABLE invitations ADD COLUMN purpose text NOT NULL DEFAULT 'invite';

pinecall/postgres/migrations/0091_head_opened_by.sql

@@ -0,0 +1,6 @@
+-- Who opened a call's log (log/store.py Claim): the fleet's worker, an org's own worker (an app
+-- key), or the gateway itself for a written call. The worker doors of a call the fleet opened
+-- take the fleet's key alone; a written call's take nobody's. NULL is a call opened before this
+-- column, served as before.
+-- New column, nullable: nothing that exists stops reading.
+ALTER TABLE call_log_head ADD COLUMN opened_by text;

pinecall/postgres/migrations/0092_key_parent.sql

@@ -0,0 +1,6 @@
+-- The key a key was copied from (tenancy/signin.py sign_in_with_code: a login code a key minted
+-- signs a browser in with a copy of it). Revoking a key revokes every copy made of it, and every
+-- copy of those: a leaked key can no longer outlive its revocation through a copy.
+-- New column, nullable: nothing that exists stops reading.
+ALTER TABLE api_keys ADD COLUMN parent text;
+CREATE INDEX api_keys_parent ON api_keys (parent) WHERE parent IS NOT NULL;

pinecall/postgres/migrations/0093_code_tries.sql

@@ -0,0 +1,10 @@
+-- How many codes each call keyed (tenancy/codes.py): a call tries three, then no page is tied to
+-- it, whatever it keys. Kept here so the count holds whichever gateway serves the call; a row
+-- leaves a day after its call's first try.
+-- A new table: CREATE TABLE locks nothing that exists.
+CREATE TABLE code_tries (
+    call text PRIMARY KEY,
+    tries integer NOT NULL,
+    first_at double precision NOT NULL
+);
+CREATE INDEX code_tries_first_at ON code_tries (first_at);

pinecall/postgres/migrations/0094_route_approval.sql

@@ -0,0 +1,12 @@
+-- A number the org hooked itself (pointed at the box from its own carrier) proves nothing about
+-- whose it is, so the operator approves it before a call to it is opened (channels/routes.py);
+-- a number bought, imported from an account of the org or typed by the operator is approved as
+-- it is written. Every row already written keeps answering: it reads approved at this migration.
+-- New columns with a default: a release before this one writes rows that read approved, as it
+-- answered them.
+ALTER TABLE routes ADD COLUMN approved_at timestamptz DEFAULT now();
+ALTER TABLE routes ADD COLUMN approved_by text;
+
+-- One org holds a number: a second org's row for it was "the older one answers". Refused here if
+-- the box holds a number twice; the operator lets one of them go first (GET /v1/ops/numbers).
+CREATE UNIQUE INDEX routes_number_held_once ON routes (number);

pinecall/postgres/migrations/0095_sso_domain_proofs.sql

@@ -0,0 +1,17 @@
+-- A domain an org's SSO admits is proven the org's by a TXT record at the domain
+-- (tenancy/sso.py): the token here, published as `pinecall-verify=<token>`, read back by the
+-- verify door. Discovery offers an org's provider for a verified domain alone, and so does the
+-- callback. Every domain already declared is verified here: the orgs that set SSO before this
+-- migration are the box's own, and their sign-in keeps working.
+-- A new table: CREATE TABLE locks nothing that exists.
+CREATE TABLE sso_domain_proofs (
+    org text NOT NULL,
+    domain text NOT NULL,
+    token text NOT NULL,
+    asked_at timestamptz NOT NULL DEFAULT now(),
+    verified_at timestamptz,
+    PRIMARY KEY (org, domain)
+);
+
+INSERT INTO sso_domain_proofs (org, domain, token, verified_at)
+SELECT org, unnest(domains), 'before-proofs', now() FROM org_sso;

pinecall/postgres/migrations/0096_row_level_security.sql

@@ -0,0 +1,38 @@
+-- Row-level security: a connection that names an org (`pinecall.org`, postgres/pool.py, set by
+-- the gateway for a tenant's request) sees and writes that org's rows alone, whatever a query
+-- forgot to say; one that names none is the box's, as the operator's doors, the loops and the
+-- nightly jobs are. Every table with an `org` column, and `orgs` by its id. The owner (the
+-- migrations, the retention) is not held to it, as Postgres never holds a table's owner.
+-- A log's head is made before its call names an org (the seal's lease, a seal), so a head with no
+-- org yet is anybody's to see and write: it holds an id and its flags, nothing of a tenant's.
+-- ENABLE takes a brief ACCESS EXCLUSIVE lock per table, CREATE POLICY the same; no row is read.
+DO $$
+DECLARE
+    found record;
+    scoped text;
+BEGIN
+    FOR found IN
+        SELECT class.relname AS name, CASE WHEN class.relname = 'orgs' THEN 'id' ELSE 'org' END AS col
+        FROM pg_class AS class
+        JOIN pg_namespace AS space ON space.oid = class.relnamespace
+        WHERE space.nspname = current_schema()
+          AND class.relkind IN ('r', 'p')
+          AND NOT class.relispartition
+          AND (class.relname = 'orgs' OR EXISTS (
+              SELECT 1 FROM pg_attribute AS attr
+              WHERE attr.attrelid = class.oid AND attr.attname = 'org' AND NOT attr.attisdropped))
+    LOOP
+        scoped := format(
+            'coalesce(current_setting(''pinecall.org'', true), '''') = '''' '
+            'OR %I = current_setting(''pinecall.org'', true)',
+            found.col
+        );
+        IF found.name = 'call_log_head' THEN
+            scoped := 'org IS NULL OR ' || scoped;
+        END IF;
+        EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', found.name);
+        EXECUTE format(
+            'CREATE POLICY org_scoped ON %I USING (%s) WITH CHECK (%s)', found.name, scoped, scoped
+        );
+    END LOOP;
+END $$;

pinecall/postgres/migrations/0097_case_status.sql

@@ -0,0 +1,19 @@
+-- A case is born at hang-up when a judge broke (evals/dataset.py `kept_at_hangup`), so it waits
+-- for a person: `pending` until approved into the nightly or dismissed. The cases that exist were
+-- kept by hand and stay `approved`. `broke` is what the panel said, `source_version` the settings
+-- version the call ran on, `kept_in_repo` a case written into the repository as a golden, which
+-- the nightly then leaves to the file.
+--
+-- Expanding only: each column has a constant default (no rewrite), the check is read over a
+-- table of a few rows per org, and the index is new.
+
+ALTER TABLE eval_cases
+    ADD COLUMN status text NOT NULL DEFAULT 'approved'
+        CHECK (status IN ('pending', 'approved', 'dismissed')),
+    ADD COLUMN broke jsonb NOT NULL DEFAULT '[]',
+    ADD COLUMN source_version integer,
+    ADD COLUMN kept_in_repo boolean NOT NULL DEFAULT false,
+    ADD COLUMN decided_by text,
+    ADD COLUMN decided_at timestamptz;
+
+CREATE INDEX eval_cases_pending ON eval_cases (org, agent) WHERE status = 'pending';