From 12b58c3eaaf42fad531ff2cf287356681f502c68 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Tue, 14 Jul 2026 16:59:23 -0500 Subject: [PATCH] docs(#769): start KBN-100 schema migration --- docs/native-kanban-sot/TASKS.md | 11 ++-- .../769-kbn100-schema-migration.md | 52 +++++++++++++++++++ 2 files changed, 58 insertions(+), 5 deletions(-) create mode 100644 docs/scratchpads/769-kbn100-schema-migration.md diff --git a/docs/native-kanban-sot/TASKS.md b/docs/native-kanban-sot/TASKS.md index d868545..db79b9c 100644 --- a/docs/native-kanban-sot/TASKS.md +++ b/docs/native-kanban-sot/TASKS.md @@ -81,9 +81,9 @@ No consumer implementation begins before KBN-105. No schema work begins before K ### KBN-010 — Threat, authorization, and constraint-impact gate -- **Status:** IN PROGRESS — issue [#753](https://git.mosaicstack.dev/mosaicstack/stack/issues/753). -- **Owner:** `kbn-coder3`; independent `secrev`. -- **Mode:** SERIAL prerequisite of KBN-100. +- **Status:** COMPLETE — PR #765 squash-merged as `2e228007`; issue #753 closed; post-merge pipeline #1813 terminal success. +- **Owner:** `kbn-coder3`; independent Homelab schema/SecReview and `web1:coder0` Codex-Ultron review. +- **Mode:** SERIAL prerequisite of KBN-100; completed. - **Exclusive files:** `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` and task scratchpad only. - **IN:** Cross-workspace owners/principals/evidence; active membership; stale/forged health; approval forgery; fence monotonicity; audit retention; proposal target/audit-event forgery; service tokens; DB/Valkey outage. - **OUT:** Runtime/schema edits. @@ -93,14 +93,15 @@ No consumer implementation begins before KBN-105. No schema work begins before K ### KBN-100 — Unified Drizzle schema and concrete N-1 migration -- **Owner:** **coder2**. +- **Status:** IN PROGRESS — issue [#769](https://git.mosaicstack.dev/mosaicstack/stack/issues/769); implementation held until tracking commit and baseline evidence are pushed. +- **Owner:** **`web1:kbn-schema-coder2`** author lane; independent DB reviewer, SecReview, and Codex-Ultron required. - **Mode:** SERIAL. - **Exclusive files:** `packages/db/src/schema.ts`, `packages/db/drizzle/**`, DB tests. - **IN:** All frozen tables/joins/enums; workspace/project-congruent constraints; owners/principals; tags/archive; change proposals with both workspace-aware task-event composite FKs and frozen event-before-proposal DDL order; assignment approvals; durable execution/quarantine; monotonic bigint fence; exact checkpoint/evidence joins; RESTRICT/immutability; concrete current-main expand/backfill/switch/contract map. - **OUT:** Repositories, Gateway, Coordinator behavior, UI, importer. - **Depends on:** **KBN-010 completed**. - **Contract surfaces:** `kanban-schema.v1.ts`; SHARED-CONTRACT current-main delta map. -- **Evidence:** reviewed SQL; empty/prod-shape/partial-resume/rollback tests; N-1 app safety; legacy columns remain declared; workspace/project mismatch negatives; proposal event-FK missing/foreign-workspace tests; one active lease; monotonic fence; parent-delete RESTRICT; immutability privileges; SecReview. +- **Evidence:** TDD RED/GREEN; reviewed generated SQL/journal; real PostgreSQL empty/prod-shape/partial-resume/rollback tests; N-1 startup/read/write safety; legacy columns remain declared; workspace/project mismatch negatives; N100-01..50 including rc.4 candidate-before-FK and two-child foreign-workspace tests; proposal event-FK missing/foreign/unrelated tests; one active lease; monotonic fence; parent-delete RESTRICT; immutability privileges; independent DB review, SecReview, Codex-Ultron, terminal-green PR/main CI. ### KBN-105 — Exact Gateway/MCP endpoint, DTO, and error freeze diff --git a/docs/scratchpads/769-kbn100-schema-migration.md b/docs/scratchpads/769-kbn100-schema-migration.md new file mode 100644 index 0000000..e81944a --- /dev/null +++ b/docs/scratchpads/769-kbn100-schema-migration.md @@ -0,0 +1,52 @@ +# Issue #769 — KBN-100 unified schema and N-1 migration + +## Status + +IN PROGRESS — tracking and baseline gate. No schema or migration implementation is authorized until this scratchpad and `docs/native-kanban-sot/TASKS.md` are committed/pushed and baseline evidence is recorded. + +## Requirement authority + +- Provider issue: +- Canonical requirements: `docs/requirements/native-kanban-sot.md` +- Frozen integration contract: `docs/native-kanban-sot/SHARED-CONTRACT.md` v1.0.0-rc.4 +- Frozen target schema: `docs/native-kanban-sot/contracts/kanban-schema.v1.ts` +- Threat/auth/constraint gate: `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` +- Dependency evidence: PR #765 merge `2e228007`, issue #753 closed, post-main pipeline #1813 terminal success. + +## Fixed decisions + +1. PostgreSQL is the sole writable project/task/orchestration SOT; generated projections and external transports are never import/write authority. +2. Expand is additive and N-1-safe. Do not drop, rename, narrow, or reinterpret legacy data during this card. +3. Backfill is bounded, idempotent, resumable, checksummed, and quarantines ambiguity rather than guessing. +4. rc.4 SI-001 creates `missions_workspace_id_uidx(workspace_id,id)` before both dependent artifact/approval FKs while retaining global and project-congruent keys. +5. Runtime repositories, Gateway/MCP, Coordinator behavior, clients, fleet, channels, connector fencing, deployment, and production migration execution are out of scope. +6. Critical schema/data behavior uses TDD RED/GREEN and real PostgreSQL integration evidence; PGlite-only evidence cannot certify the migration. + +## Authorized paths + +- `packages/db/src/schema.ts` +- `packages/db/drizzle/**` +- DB-package tests/config files explicitly enumerated by the author before first edit +- `docs/native-kanban-sot/TASKS.md` +- this scratchpad + +Any additional path requires control-plane approval before edit. + +## Delivery cycle + +`baseline -> test design/RED -> schema+migration GREEN -> focused tests -> real PostgreSQL migration matrix -> full gates -> independent DB review -> SecReview -> remediate/rereview -> Codex-Ultron -> PR CI -> squash merge -> post-main CI -> issue close` + +## Baseline evidence + +Pending fresh author-lane intake and baseline test run. + +## Collision boundaries + +- #758 owns generic local Fleet configuration/lifecycle cards. +- #757/#755 owns logical-agent connector identity/lease/fencing. +- #756 channel foundation is merged and remains separate. +- KBN-105 and all KBN consumers remain held until #769 completes. + +## Completion evidence + +Pending implementation, reviews, PR, merge, terminal-green main CI, and issue closure.