deploy/apply-migrations.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="${REPO_DIR:-$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)}"
+ENV_FILE="${ENV_FILE:-/home/m/assistant-deploy/production-compose.env}"
+POSTGRES_CONTAINER="${POSTGRES_CONTAINER:-assistant-postgres-1}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "migration runner: env file is missing" >&2
+  exit 1
+fi
+
+set -a
+# The deployment env file is controlled by the production operator. Values
+# are used only by the local Docker/psql boundary and are never logged.
+. "$ENV_FILE"
+set +a
+
+: "${POSTGRES_SUPERUSER:?POSTGRES_SUPERUSER is required}"
+DATABASE="${POSTGRES_DB:-assistant}"
+
+psql_exec() {
+  docker exec -i "$POSTGRES_CONTAINER" psql -v ON_ERROR_STOP=1 -U "$POSTGRES_SUPERUSER" -d "$DATABASE" "$@"
+}
+
+psql_exec -c "CREATE TABLE IF NOT EXISTS public.assistant_migration_history (migration_id TEXT PRIMARY KEY, applied_at_unix_millis BIGINT NOT NULL CHECK (applied_at_unix_millis > 0));"
+
+if [[ -n "${MIGRATION_BASELINE:-}" ]]; then
+  if [[ ! "$MIGRATION_BASELINE" =~ ^[0-9]{3}$ ]]; then
+    echo "migration runner: invalid MIGRATION_BASELINE" >&2
+    exit 1
+  fi
+  now_ms="$(date +%s%3N)"
+  for file in "$REPO_DIR"/database/migrations/[0-9][0-9][0-9]_*.sql; do
+    migration_id="$(basename "$file" .sql)"
+    number="${migration_id:0:3}"
+    if (( 10#$number <= 10#$MIGRATION_BASELINE )); then
+      psql_exec -v migration_id="$migration_id" -v applied_at="$now_ms" -c "INSERT INTO public.assistant_migration_history(migration_id, applied_at_unix_millis) VALUES (:'migration_id', :'applied_at') ON CONFLICT (migration_id) DO NOTHING;"
+    fi
+  done
+fi
+
+for file in "$REPO_DIR"/database/migrations/[0-9][0-9][0-9]_*.sql; do
+  [[ -f "$file" ]] || continue
+  migration_id="$(basename "$file" .sql)"
+  applied="$(psql_exec -At -v migration_id="$migration_id" -c "SELECT 1 FROM public.assistant_migration_history WHERE migration_id=:'migration_id' LIMIT 1;")"
+  [[ "$applied" == "1" ]] && continue
+  psql_exec < "$file"
+  now_ms="$(date +%s%3N)"
+  psql_exec -v migration_id="$migration_id" -v applied_at="$now_ms" -c "INSERT INTO public.assistant_migration_history(migration_id, applied_at_unix_millis) VALUES (:'migration_id', :'applied_at');"
+done

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
   "task_file": "dev/tasks/DEV-000115-cognitive-admission-control.json",
   "task_id": "DEV-000115",
-  "task_revision": 3
+  "task_revision": 4
 }

dev/tasks/DEV-000115-cognitive-admission-control.json

@@ -1,12 +1,12 @@
 {
   "task_id": "DEV-000115",
-  "task_revision": 3,
+  "task_revision": 4,
   "architecture_revision": "ADR-0018",
   "base_repo_revision": "9b26260",
   "risk_tier": "E",
   "intent": "Run bounded cognitive admission as a durable capability-owner lease with restart recovery, while preserving provider routing and explicit fallback.",
   "requirement_ids": ["WP-203", "Bounded concurrency/rate limits", "Durable admission lease", "Explainable admission decision"],
-  "allowed_change_scope": {"modules": ["cognitive-admission", "core-runtime", "cognitive-worker", "deployment"], "paths": ["contracts/capability/**", "adapters/postgres/capability_repository.go", "database/migrations/033_cognitive_admission_leases.sql", "cmd/core-runtime/main.go", "cmd/cognitive-worker/**", "deploy/docker-compose.prod.yml", "tests/cognitive_admission/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000115-cognitive-admission-control.json"]},
+  "allowed_change_scope": {"modules": ["cognitive-admission", "core-runtime", "cognitive-worker", "deployment"], "paths": ["contracts/capability/**", "adapters/postgres/capability_repository.go", "database/migrations/033_cognitive_admission_leases.sql", "cmd/core-runtime/main.go", "cmd/cognitive-worker/**", "deploy/docker-compose.prod.yml", "deploy/apply-migrations.sh", "tests/cognitive_admission/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000115-cognitive-admission-control.json"]},
   "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "modules/authority/**", "modules/work/**", ".gitea/**"]},
   "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
   "contracts": {"consume": ["Existing cognitive capability registry and LimitPolicyRef", "ADR-0006 bounded advisory boundary", "capability-owned PostgreSQL schema"], "may_change": ["Typed admission request/policy/decision and lease contract"]},
@@ -14,7 +14,7 @@
   "canonical_state": ["capability.cognitive_admission_counters", "capability.cognitive_admission_leases"],
   "state_transitions": ["request + policy + durable counters -> admitted lease or typed rejection", "active lease -> released/expired"],
   "side_effects_and_privileges": ["Capability database role only; internal core endpoint; provider calls remain behind cognitive gateway"],
-  "persistence_and_migrations": ["database/migrations/033_cognitive_admission_leases.sql"],
+  "persistence_and_migrations": ["database/migrations/033_cognitive_admission_leases.sql", "deploy/apply-migrations.sh records applied migration IDs and is idempotent"],
   "failure_retry_restart": ["Expired leases are recovered on next admission transaction; duplicate request IDs are idempotent; rejected requests fall back locally"],
   "assumptions": ["Core Runtime remains the capability-owner admission boundary", "Policy does not choose or activate providers", "Deadline and budgets are request requirements"],
   "acceptance_scenarios": ["Concurrency limit rejects excess request", "Accepted/hour limit rejects excess request", "Deadline and byte budget reject invalid request", "Admitted decision exposes reason and policy reference", "expired lease does not permanently block after restart", "cognitive worker uses admission before provider and releases lease"],