primarypath-server 1.0.0__py3-none-any.whl

app/migrations/versions/0011_budgets_and_evals.py

@@ -0,0 +1,75 @@
+"""budget_view (folded budgets/quotas) + eval/gate history projections.
+
+All three are rebuildable caches of chained events (budget_set,
+eval_recorded, gate_decision) — same discipline as policy_view/approvals_view.
+Spend is NOT stored: it is folded live from run_event usage (no cached
+counter that can drift). Per tenant.
+
+Revision ID: 0011
+Revises: 0010
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0011"
+down_revision = "0010"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        CREATE TABLE budget_view (
+            tenant_id     TEXT NOT NULL,
+            scope         TEXT NOT NULL,   -- 'tenant' | 'action'
+            key           TEXT NOT NULL,   -- action name, or '*' for the tenant
+            max_usd       DOUBLE PRECISION,
+            max_tokens    BIGINT,
+            window_kind   TEXT NOT NULL,   -- 'per_run' | 'daily' | 'monthly'
+                                           -- ('window' is a reserved keyword)
+            on_exceed     TEXT NOT NULL,   -- 'gate' | 'deny'
+            updated_by    TEXT,
+            reason        TEXT,
+            updated_ts_ms BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, scope, key)
+        )
+    """)
+    # Latest gate verdict per (tenant, agent, version): a fold of gate_decision
+    # (an override is just a newer gate_decision, last-write-wins).
+    op.execute("""
+        CREATE TABLE gate_view (
+            tenant_id        TEXT NOT NULL,
+            agent            TEXT NOT NULL,
+            version          TEXT NOT NULL,
+            passed           BOOLEAN NOT NULL,
+            baseline_version TEXT,
+            blocks           JSONB NOT NULL DEFAULT '[]'::jsonb,
+            override         BOOLEAN NOT NULL DEFAULT false,
+            decided_by       TEXT,
+            reason           TEXT,
+            decided_ts_ms    BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, agent, version)
+        )
+    """)
+    # Append-only history rows for eval profiles and gate decisions, for the
+    # console history view (the chain remains the source of truth).
+    op.execute("""
+        CREATE TABLE eval_history (
+            id         BIGSERIAL PRIMARY KEY,
+            tenant_id  TEXT NOT NULL,
+            kind       TEXT NOT NULL,   -- 'eval' | 'gate'
+            agent      TEXT NOT NULL,
+            version    TEXT NOT NULL,
+            detail     JSONB NOT NULL,
+            ts_ms      BIGINT NOT NULL
+        )
+    """)
+    op.execute("CREATE INDEX eval_history_lookup_idx "
+               "ON eval_history (tenant_id, agent, version)")
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE eval_history")
+    op.execute("DROP TABLE gate_view")
+    op.execute("DROP TABLE budget_view")

app/migrations/versions/0012_run_event_ts_index.py

@@ -0,0 +1,23 @@
+"""Index the cost-fold path: daily/monthly spend scans filter run_events by
+(tenant_id, ts_ms). (per_run already uses events_tenant_run_idx from 0007.)
+
+Revision ID: 0012
+Revises: 0011
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0012"
+down_revision = "0011"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE INDEX events_tenant_type_ts_idx "
+               "ON events (tenant_id, type, ts_ms)")
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX events_tenant_type_ts_idx")

app/migrations/versions/0013_agent_chains.py

@@ -0,0 +1,102 @@
+"""F24: chain-per-agent. The chain scope generalizes from tenant to
+(tenant_id, chain_id): activity events live on per-agent chains
+(chain_id = agent_id), control-plane events on a per-tenant governance
+chain (chain_id = '__governance__'). Every event row carries the
+agent_id/unit stamped from the service token; api_tokens carries the
+agent-to-unit map. evidence_view / agents_view / config_view are folds of
+governance events (rebuildable caches, like approvals_view).
+
+Existing events adopt chain_id = 'default' (and agent_id = 'default'), so
+a one-agent install keeps its F20 tenant chain byte-for-byte.
+
+`rowid` is a global ingest-order identity used ONLY for cross-chain reads
+(SIEM cursor, whole-log listings). It is not part of any hash; per-chain
+`seq`/`prev_hash` remain the tamper-evidence.
+
+Revision ID: 0013
+Revises: 0012
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0013"
+down_revision = "0012"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # ADD COLUMN ... DEFAULT is metadata-only for existing rows (no row
+    # rewrite, so the append-only trigger is not in play). The identity
+    # column backfills in physical (insert) order.
+    op.execute("ALTER TABLE events ADD COLUMN chain_id TEXT NOT NULL "
+               "DEFAULT 'default'")
+    op.execute("ALTER TABLE events ADD COLUMN agent_id TEXT DEFAULT 'default'")
+    op.execute("ALTER TABLE events ALTER COLUMN agent_id DROP DEFAULT")
+    op.execute("ALTER TABLE events ADD COLUMN unit TEXT")
+    op.execute("ALTER TABLE events ADD COLUMN rowid BIGINT "
+               "GENERATED ALWAYS AS IDENTITY")
+    op.execute("ALTER TABLE events DROP CONSTRAINT events_pkey")
+    op.execute("ALTER TABLE events ADD PRIMARY KEY (tenant_id, chain_id, seq)")
+    op.execute("CREATE INDEX events_tenant_rowid_idx ON events "
+               "(tenant_id, rowid)")
+
+    op.execute("ALTER TABLE approvals_view ADD COLUMN agent_id TEXT NOT NULL "
+               "DEFAULT 'default'")
+    op.execute("ALTER TABLE approvals_view ADD COLUMN unit TEXT")
+
+    # the agent-to-unit map rides the service token (resolved server-side,
+    # never from the request body — the F20 tenant discipline)
+    op.execute("ALTER TABLE api_tokens ADD COLUMN agent_id TEXT")
+    op.execute("ALTER TABLE api_tokens ADD COLUMN unit TEXT")
+
+    # cursor moves from per-chain seq to global ingest order; reset is safe
+    # (redelivery is deduped at the SIEM)
+    op.execute("DROP TABLE siem_cursor")
+    op.execute("""
+        CREATE TABLE siem_cursor (
+            tenant_id  TEXT PRIMARY KEY,
+            last_rowid BIGINT NOT NULL
+        )
+    """)
+
+    # folds of governance events (rebuildable caches, never the truth)
+    op.execute("""
+        CREATE TABLE agents_view (
+            tenant_id     TEXT NOT NULL,
+            agent         TEXT NOT NULL,
+            unit          TEXT,
+            updated_by    TEXT,
+            reason        TEXT,
+            updated_ts_ms BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, agent)
+        )
+    """)
+    op.execute("""
+        CREATE TABLE evidence_view (
+            tenant_id       TEXT NOT NULL,
+            agent           TEXT NOT NULL,
+            signing_backend TEXT NOT NULL,
+            key_id          TEXT,
+            capture         TEXT NOT NULL,
+            retention_days  BIGINT,
+            updated_by      TEXT,
+            reason          TEXT,
+            updated_ts_ms   BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, agent)
+        )
+    """)
+    op.execute("""
+        CREATE TABLE config_view (
+            tenant_id     TEXT NOT NULL,
+            key           TEXT NOT NULL,
+            value         JSONB NOT NULL,
+            updated_ts_ms BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, key)
+        )
+    """)
+
+
+def downgrade() -> None:
+    raise NotImplementedError("per-agent chains are a one-way seam")

app/migrations/versions/0014_dual_control.py

@@ -0,0 +1,33 @@
+"""Dual control (four-eyes): a per-action policy can demand a second,
+different approver. The first approval appends an `approval_endorsed`
+event (the approval STAYS pending); only a different reviewer's approval
+appends `approval_granted`. Both humans are on the chain.
+
+policy_view gains the flag; approvals_view caches the endorsement so the
+queue can show "1 of 2" without folding the log per row. Both are pure
+projections — the log stays truth and a rebuild reproduces them.
+
+Revision ID: 0014
+Revises: 0013
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0014"
+down_revision = "0013"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE policy_view ADD COLUMN require_second_approval "
+               "BOOLEAN NOT NULL DEFAULT FALSE")
+    op.execute("ALTER TABLE approvals_view ADD COLUMN endorsed_by TEXT")
+    op.execute("ALTER TABLE approvals_view ADD COLUMN endorsed_ts_ms BIGINT")
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE approvals_view DROP COLUMN endorsed_ts_ms")
+    op.execute("ALTER TABLE approvals_view DROP COLUMN endorsed_by")
+    op.execute("ALTER TABLE policy_view DROP COLUMN require_second_approval")

app/migrations/versions/0015_sampled_mode.py

@@ -0,0 +1,24 @@
+"""Sampled autonomy: policy mode 'sampled' auto-grants most of an action's
+proposals but routes a deterministic 1-in-N to a human. policy_view gains
+the sampling denominator; 0 means not applicable (non-sampled modes).
+
+Revision ID: 0015
+Revises: 0014
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0015"
+down_revision = "0014"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE policy_view ADD COLUMN sample_n INTEGER "
+               "NOT NULL DEFAULT 0")
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE policy_view DROP COLUMN sample_n")

app/migrations/versions/0016_sampling_salt.py

@@ -0,0 +1,25 @@
+"""Sampling salt: the sampled-mode 1-in-N pick becomes an HMAC keyed by a
+per-tenant server secret, so an agent (who chooses run_id:call_id) cannot
+grind ids that are never sampled. Operational, not chained; disclosed in
+the admin-gated export so an auditor can still recompute every pick.
+
+Revision ID: 0016
+Revises: 0015
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0016"
+down_revision = "0015"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE TABLE sampling_salt ("
+               "tenant_id TEXT PRIMARY KEY, salt TEXT NOT NULL)")
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE sampling_salt")

app/migrations/versions/0017_live_tokens_index.py

@@ -0,0 +1,25 @@
+"""Partial index over live issued tokens: the token-plane posture check
+(does any live service/admin token exist?) runs on the authentication
+boundary of every request in issued-token-only deployments, uncached so
+every replica sees the same answer. Keep that EXISTS an index probe.
+
+Revision ID: 0017
+Revises: 0016
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0017"
+down_revision = "0016"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE INDEX IF NOT EXISTS api_tokens_live_kind_idx "
+               "ON api_tokens (kind) WHERE revoked_ts_ms IS NULL")
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX IF EXISTS api_tokens_live_kind_idx")

app/migrations/versions/0018_webhook_outbox.py

@@ -0,0 +1,47 @@
+"""Webhook outbox: a callback is written in the SAME transaction as the
+decision it announces, then delivered by a leased worker with capped
+backoff, a dead-letter state, and admin replay. At-least-once for real:
+a crash after the decision commits can no longer lose the callback,
+because the callback IS committed with it. Operational state, not part
+of the audit chain (the decision event is the truth; this is transport).
+
+Revision ID: 0018
+Revises: 0017
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0018"
+down_revision = "0017"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        CREATE TABLE webhook_outbox (
+            id BIGSERIAL PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            kind TEXT NOT NULL,
+            approval_id TEXT,
+            event_hash TEXT,
+            url TEXT NOT NULL,
+            payload_json JSONB NOT NULL,
+            status TEXT NOT NULL DEFAULT 'pending',
+            attempts INTEGER NOT NULL DEFAULT 0,
+            created_ts_ms BIGINT NOT NULL,
+            next_attempt_ts_ms BIGINT NOT NULL,
+            delivered_ts_ms BIGINT,
+            last_status INTEGER,
+            last_error TEXT
+        )
+    """)
+    op.execute("CREATE INDEX webhook_outbox_due_idx ON webhook_outbox "
+               "(next_attempt_ts_ms, id) WHERE status = 'pending'")
+    op.execute("CREATE INDEX webhook_outbox_tenant_idx ON webhook_outbox "
+               "(tenant_id, status, id DESC)")
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE IF EXISTS webhook_outbox")

app/migrations/versions/0019_usage_view_and_rollout_index.py

@@ -0,0 +1,68 @@
+"""usage_view: a rebuildable projection of model_decision usage (one row
+per decision: model, tokens, the tools it called), so budgets and the
+spend report are SQL aggregates over an indexed table instead of an
+application-side fold of every run_event in the window. Backfilled from
+the log here; kept current by apply_event; reproduced by
+rebuild_projection like every other view.
+
+Also indexes approvals_view for the rollout track record, which is now
+a GROUP BY over (tenant, tool) within an explicit lookback window.
+
+Revision ID: 0019
+Revises: 0018
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0019"
+down_revision = "0018"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        CREATE TABLE usage_view (
+            id BIGSERIAL PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            run_id TEXT,
+            ts_ms BIGINT NOT NULL,
+            model TEXT NOT NULL,
+            input_tokens BIGINT NOT NULL DEFAULT 0,
+            output_tokens BIGINT NOT NULL DEFAULT 0,
+            tools TEXT[] NOT NULL DEFAULT '{}'
+        )
+    """)
+    op.execute("CREATE INDEX usage_view_tenant_ts_idx ON usage_view "
+               "(tenant_id, ts_ms)")
+    op.execute("CREATE INDEX usage_view_tenant_run_idx ON usage_view "
+               "(tenant_id, run_id)")
+    op.execute("CREATE INDEX usage_view_tools_idx ON usage_view USING GIN (tools)")
+    # backfill from the log, in append order
+    op.execute("""
+        INSERT INTO usage_view
+            (tenant_id, run_id, ts_ms, model, input_tokens, output_tokens, tools)
+        SELECT tenant_id, run_id, ts_ms,
+               coalesce(p->'payload'->>'model', 'unknown'),
+               coalesce(nullif(p->'payload'->'usage'->>'input_tokens', '')::numeric::bigint, 0),
+               coalesce(nullif(p->'payload'->'usage'->>'output_tokens', '')::numeric::bigint, 0),
+               coalesce(ARRAY(
+                   SELECT c->>'name'
+                   FROM jsonb_array_elements(
+                       CASE WHEN jsonb_typeof(p->'payload'->'tool_calls') = 'array'
+                            THEN p->'payload'->'tool_calls' ELSE '[]'::jsonb END) AS c
+                   WHERE c->>'name' IS NOT NULL), '{}')
+        FROM (SELECT tenant_id, run_id, ts_ms, rowid,
+                     (payload_json::jsonb)->'event' AS p
+              FROM events WHERE type = 'run_event') AS e
+        WHERE p->>'type' = 'model_decision'
+        ORDER BY rowid
+    """)
+    op.execute("CREATE INDEX approvals_view_tenant_tool_ts_idx ON approvals_view "
+               "(tenant_id, tool, requested_ts_ms)")
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX IF EXISTS approvals_view_tenant_tool_ts_idx")
+    op.execute("DROP TABLE IF EXISTS usage_view")

app/migrations/versions/0020_policy_metadata_and_lifecycle.py

@@ -0,0 +1,67 @@
+"""Server-authored risk metadata and a fuller approval lifecycle.
+
+policy_view gains risk (low/medium/high/critical), blast_radius (free
+text the admin authors) and version (the first 12 hex of the policy_set
+event's chain hash — the exact rule a request was evaluated against).
+
+approvals_view gains the request-time snapshot the console shows and the
+server enforces on: disposition, action_digest, policy (the rule as it
+stood, with its version), rule_result (why it was gated or not), and
+supersedes. status may now also be cancelled / expired / superseded /
+changes_requested. Backfilled from the log.
+
+Revision ID: 0020
+Revises: 0019
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0020"
+down_revision = "0019"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE policy_view ADD COLUMN risk TEXT NOT NULL "
+               "DEFAULT 'medium'")
+    op.execute("ALTER TABLE policy_view ADD COLUMN blast_radius TEXT")
+    op.execute("ALTER TABLE policy_view ADD COLUMN version TEXT")
+    op.execute("""
+        UPDATE policy_view pv SET
+            version = left(e.hash, 12),
+            risk = coalesce(e.payload_json->>'risk',
+                            CASE WHEN pv.reversible THEN 'medium' ELSE 'high' END),
+            blast_radius = e.payload_json->>'blast_radius'
+        FROM (
+            SELECT DISTINCT ON (tenant_id, payload_json->>'action')
+                   tenant_id, payload_json->>'action' AS action, hash, payload_json
+            FROM events WHERE type = 'policy_set'
+            ORDER BY tenant_id, payload_json->>'action', rowid DESC
+        ) e
+        WHERE e.tenant_id = pv.tenant_id AND e.action = pv.action
+    """)
+    for col, typ in (("disposition", "TEXT"), ("action_digest", "TEXT"),
+                     ("policy", "JSONB"), ("rule_result", "JSONB"),
+                     ("supersedes", "TEXT")):
+        op.execute(f"ALTER TABLE approvals_view ADD COLUMN {col} {typ}")
+    op.execute("""
+        UPDATE approvals_view av SET
+            disposition = e.payload_json->>'disposition',
+            action_digest = e.payload_json->>'action_digest',
+            policy = e.payload_json->'policy',
+            rule_result = e.payload_json->'rule_result',
+            supersedes = e.payload_json->>'supersedes'
+        FROM events e
+        WHERE e.type = 'approval_requested' AND e.tenant_id = av.tenant_id
+              AND e.payload_json->>'approval_id' = av.approval_id
+    """)
+
+
+def downgrade() -> None:
+    for col in ("disposition", "action_digest", "policy", "rule_result",
+                "supersedes"):
+        op.execute(f"ALTER TABLE approvals_view DROP COLUMN {col}")
+    for col in ("risk", "blast_radius", "version"):
+        op.execute(f"ALTER TABLE policy_view DROP COLUMN {col}")

app/migrations/versions/0021_execution_grants.py

@@ -0,0 +1,59 @@
+"""Signed execution grants (the approve→execute seam).
+
+approvals_view caches the grant stamped into `approval_granted` (nonce,
+issue/expiry, key id, signature) and its single redemption
+(`grant_redeemed`: when, by which executor). Backfilled from the log;
+kept current by apply_event; reproduced by rebuild_projection.
+
+Revision ID: 0021
+Revises: 0020
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0021"
+down_revision = "0020"
+branch_labels = None
+depends_on = None
+
+COLUMNS = (("grant_nonce", "TEXT"), ("grant_issued_ms", "BIGINT"),
+           ("grant_expires_ms", "BIGINT"), ("grant_key_id", "TEXT"),
+           ("grant_signature", "TEXT"), ("grant_redeemed_ts_ms", "BIGINT"),
+           ("grant_redeemed_by", "TEXT"))
+
+
+def upgrade() -> None:
+    for col, typ in COLUMNS:
+        op.execute(f"ALTER TABLE approvals_view ADD COLUMN {col} {typ}")
+    op.execute("""
+        UPDATE approvals_view av SET
+            grant_nonce = e.payload_json->'grant'->>'nonce',
+            grant_issued_ms = (e.payload_json->'grant'->>'issued_ms')::bigint,
+            grant_expires_ms = (e.payload_json->'grant'->>'expires_ms')::bigint,
+            grant_key_id = e.payload_json->'grant'->>'key_id',
+            grant_signature = e.payload_json->'grant'->>'signature'
+        FROM events e
+        WHERE e.type = 'approval_granted' AND e.tenant_id = av.tenant_id
+              AND e.payload_json->>'approval_id' = av.approval_id
+              AND e.payload_json->'grant'->>'nonce' IS NOT NULL
+    """)
+    op.execute("""
+        UPDATE approvals_view av SET
+            grant_redeemed_ts_ms = r.ts_ms,
+            grant_redeemed_by = r.payload_json->>'executor'
+        FROM (
+            SELECT DISTINCT ON (tenant_id, payload_json->>'approval_id')
+                   tenant_id, payload_json->>'approval_id' AS approval_id,
+                   ts_ms, payload_json
+            FROM events WHERE type = 'grant_redeemed'
+            ORDER BY tenant_id, payload_json->>'approval_id', rowid
+        ) r
+        WHERE r.tenant_id = av.tenant_id AND r.approval_id = av.approval_id
+              AND r.payload_json->>'nonce' = av.grant_nonce
+    """)
+
+
+def downgrade() -> None:
+    for col, _ in COLUMNS:
+        op.execute(f"ALTER TABLE approvals_view DROP COLUMN {col}")

app/migrations/versions/0022_digest_alg_and_executor_instance.py

@@ -0,0 +1,45 @@
+"""Cross-language action digests and credential-bound executors.
+
+approvals_view gains digest_alg ("jcs" for approvals whose action_digest
+is RFC 8785 canonical; NULL for pre-0.3 Python-canonical digests) and
+grant_redeemed_instance (the executor's self-asserted name, kept apart
+from grant_redeemed_by, which is now the credential-derived identity).
+Backfilled from the log.
+
+Revision ID: 0022
+Revises: 0021
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0022"
+down_revision = "0021"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE approvals_view ADD COLUMN digest_alg TEXT")
+    op.execute("ALTER TABLE approvals_view ADD COLUMN grant_redeemed_instance TEXT")
+    op.execute("""
+        UPDATE approvals_view av SET digest_alg = e.payload_json->>'digest_alg'
+        FROM events e
+        WHERE e.type = 'approval_requested' AND e.tenant_id = av.tenant_id
+              AND e.payload_json->>'approval_id' = av.approval_id
+              AND e.payload_json->>'digest_alg' IS NOT NULL
+    """)
+    op.execute("""
+        UPDATE approvals_view av SET
+            grant_redeemed_instance = r.payload_json->>'executor_instance'
+        FROM events r
+        WHERE r.type = 'grant_redeemed' AND r.tenant_id = av.tenant_id
+              AND r.payload_json->>'approval_id' = av.approval_id
+              AND r.payload_json->>'nonce' = av.grant_nonce
+              AND r.payload_json->>'executor_instance' IS NOT NULL
+    """)
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE approvals_view DROP COLUMN grant_redeemed_instance")
+    op.execute("ALTER TABLE approvals_view DROP COLUMN digest_alg")

app/migrations/versions/0023_idempotency_keys.py

@@ -0,0 +1,38 @@
+"""Operation idempotency keys.
+
+A mutating request may carry `Idempotency-Key`. The key is recorded in
+the SAME transaction as the events it produces, with a fingerprint of
+(tenant, credential, method, path, body) and the response it earned, so
+a retry after a lost response returns that response instead of writing
+again, and a crash between commit and response cannot duplicate
+anything. Operational state, not part of the audit chain.
+
+Revision ID: 0023
+Revises: 0022
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0023"
+down_revision = "0022"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        CREATE TABLE idempotency_keys (
+            tenant_id TEXT NOT NULL,
+            key TEXT NOT NULL,
+            fingerprint TEXT NOT NULL,
+            result JSONB NOT NULL,
+            created_ts_ms BIGINT NOT NULL,
+            PRIMARY KEY (tenant_id, key)
+        )
+    """)
+    op.execute("CREATE INDEX idempotency_keys_created_idx ON idempotency_keys (created_ts_ms)")
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE idempotency_keys")

app/migrations/versions/0024_approvals_view_keyset_index.py

@@ -0,0 +1,26 @@
+"""approvals_view: an index for the list endpoint's total order.
+
+The inbox pages the queue by (requested_ts_ms, approval_id), oldest or
+newest first, with a keyset cursor. Without an index every page sorts the
+tenant's whole view; with it a page is a range scan in either direction.
+
+Revision ID: 0024
+Revises: 0023
+"""
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0024"
+down_revision = "0023"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE INDEX approvals_view_tenant_ts_id_idx ON approvals_view "
+               "(tenant_id, requested_ts_ms, approval_id)")
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX IF EXISTS approvals_view_tenant_ts_id_idx")