feat(store): forge authored-artifact ownership index (RIG-2170) - #404
Open
rigel-mintaka wants to merge 2 commits into
Open
feat(store): forge authored-artifact ownership index (RIG-2170)#404rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Compass engineering docs preview: https://compass-server-rig-2236-forg.compass-eng-docs.pages.dev Deployed from |
Add the DL-055 forge ownership index: the durable record of every forge artifact Compass authors on behalf of an agent. Migration 0002_forge_authored_artifacts creates `forge_authored_artifacts` keyed on the forge coordinate (provider, host, repo, kind, number), with FKs to agent_accounts/user_accounts ON DELETE RESTRICT so a referenced account cannot be orphaned out from under an ownership row, and CHECK domains on provider and kind. `RecordAuthoredArtifact` writes the row and the F3 idempotency memo in one INSERT ... ON CONFLICT: a retry of the same authored create idempotently re-lands on the coordinate PK. `client_request_id` is NULLABLE (NULL when the caller supplied no key), and the per-agent memo is a UNIQUE PARTIAL index WHERE client_request_id IS NOT NULL, so null-key rows never collide. `AuthoredArtifactByRequestID` is the pre-write dedup lookup (empty key is always a miss, never returning a null-key row); `ListAuthoredArtifactsByAgent` scans one agent's artifacts in deterministic order. Tests are the DL-174 pair: a hermetic default-gate half (argument guards, empty-key short-circuit, NULL mapping) plus a pgtest suite over real Postgres covering insert/read-back, idempotent upsert, FK RESTRICT, by-agent ordering, the memo hit/miss, the UNIQUE conflict on a duplicate non-null key, null-key non-collision, and the migration CHECK domains. Refs RIG-2236. Co-authored-by: Matt Wilkinson <matt@sealedsecurity.com>
…236 review) Review (Matt-approved): the ownership-index upsert now makes authorship WRITE-ONCE. RecordAuthoredArtifact's ON CONFLICT DO UPDATE SET drops agent_account_id and owner_user_id, so re-landing a coordinate can never silently transfer who authored the artifact (matching issues.go UpsertIssueForgeFields's never-clobber-owned-fields precedent). No behaviour change on the real path — a forge never reuses a coordinate, so the only re-land is a same-agent crash-replay where author/owner are invariant. Migration 0002 now enforces (agent_account_id, owner_user_id) as a COMPOSITE FK into agent_accounts, so the store cannot record an agent under a user who is not its owner — the pair is schema-guaranteed, not just caller-correct. This adds a UNIQUE(account_id, owner_user_id) target on agent_accounts (a composite FK needs a unique constraint on the exact referenced columns; account_id alone is the PK); it subsumes the plain agent FK, and the transitive owner -> user_accounts FK already rides on agent_accounts. Tests: TestListAuthoredArtifactsByAgentOrderingTieBreak pins the coordinate tie-break at equal created_at (a dropped ORDER BY coordinate key would now redden); TestRecordAuthoredArtifactIdempotentUpsert gains a write-once assertion (re-recording a coordinate under a different agent retains the original author, thief's scan empty). All 10 pgtest cases + hermetic guards pass race-clean against real Postgres; lint 0. Refs RIG-2236. Co-authored-by: Matt Wilkinson <matt@sealedsecurity.com>
rigel-mintaka
force-pushed
the
compass-server-rig-2236-forge-authored-store
branch
from
August 19, 2026 13:55
c58d93c to
f091d14
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add the DL-055 forge ownership index: the durable record of every forge artifact Compass authors on behalf of an agent. Migration 0002_forge_authored_artifacts creates
forge_authored_artifactskeyed on the forge coordinate (provider, host, repo, kind, number), with FKs to agent_accounts/user_accounts ON DELETE RESTRICT so a referenced account cannot be orphaned out from under an ownership row, and CHECK domains on provider and kind.RecordAuthoredArtifactwrites the row and the F3 idempotency memo in one INSERT ... ON CONFLICT: a retry of the same authored create idempotently re-lands on the coordinate PK.client_request_idis NULLABLE (NULL when the caller supplied no key), and the per-agent memo is a UNIQUE PARTIAL index WHERE client_request_id IS NOT NULL, so null-key rows never collide.AuthoredArtifactByRequestIDis the pre-write dedup lookup (empty key is always a miss, never returning a null-key row);ListAuthoredArtifactsByAgentscans one agent's artifacts in deterministic order.Tests are the DL-174 pair: a hermetic default-gate half (argument guards, empty-key short-circuit, NULL mapping) plus a pgtest suite over real Postgres covering insert/read-back, idempotent upsert, FK RESTRICT, by-agent ordering, the memo hit/miss, the UNIQUE conflict on a duplicate non-null key, null-key non-collision, and the migration CHECK domains.
Refs RIG-2236.
Co-authored-by: Matt Wilkinson matt@sealedsecurity.com