Persist exact workflow revisions additively

[loganj]

🤖
I’m Larry.

Summary

Record the exact signed workflow definition when materializing a workflow and copy that revision into new runs. Signed event persistence and materialization commit together. During mixed-version rollout, an older writer clears the workflow's revision reference—even on equal-value definition writes—rather than leaving false provenance. Already-created runs retain their captured reference.

Foundation for owner-authorized manual triggers #6964 and the separate agent wake slice #6965. This PR does not itself add manual authorization or agent waking. Search/index behavior is unchanged.

Schema and rollout cost

• Migration 0045 follows main's occupied 0043/0044 slots. It adds nullable definition_event_id columns to workflows and runs, length-32 NOT VALID checks, and the mixed-writer invalidation trigger. Existing rows retain unknown (NULL) provenance; no inferred historical backfill.
• NOT VALID avoids a historical validation scan while enforcing subsequent INSERT/UPDATE writes. No deferred validation job. Fresh desired-state tables retain validated checks.
• No historical event/index rewrite or new run-lookup index. The BEFORE UPDATE invalidator is a recurring write cost; definition/identity writes clear the binding, while operational enabled/status updates preserve it.
• Metadata-only is not lock-free: schema changes take relation locks. Opt-in runtime migration uses unbounded lock/statement timeouts before its advisory lock and transactional migration files. Schema-first controlled application is recommended; no bounded startup promise.
• Historical runs remain compatible with unknown revisions. Matching current content cannot establish old provenance. #6963 remains retired/closed, not part of this plan.

Published range and validation

Head d2a80d819979efbf4b02e8b322a425c91c18e046, based on main b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6. Reviewed behavior was retained through the main integration; migration placement/assertions now use 0045. Author and committer identities plus sign-offs audited for all eight outgoing commits. Exact remote head verified after lease-protected publication.

Recorded local evidence (reused, not redundantly rerun at publication):

• Foundation DB: 122 passed / 255 ignored; focused workflow DB coverage 35 passed.
• Actual SQLx fresh migration lineage 1–45 passed. Populated migration exercise retained 286 relation file IDs, legacy NULL history, unvalidated checks, new-write rejection, and mixed-writer invalidation. Prior fresh pgschema plus reconciliation evidence is retained separately.
• The complete DB package has a known unchanged-main huddle-observability source guard failure at event.rs:270 (fetch_all(pool)). This is not represented as a full-package pass or silently repaired in this feature.
• Evidence custody: local artifacts/workflow-54970053/, artifacts/workflow-7c57fa89/, and publication audit artifacts/workflow-publish-092513c4/ in the coordinating workspace.

Final-head gates completed: CI 33868189396 and Docker 33868189182 succeeded without reruns. GitHub reports 52 successful / 28 skipped checks, none pending/failing. The PostgreSQL domain actually ran 382 tests, all passed; the producer-topology skips are not being substituted for that execution. Fresh exact-head approval reviews 5112467936 and 5112468449 report no author action. GitHub reports APPROVED, MERGEABLE and CLEAN. These are repository review/CI results, not deployment authorization. No merge, auto-merge, ready-state promotion, deployment or live-database operation performed.

[jedwards27]

Review verdict: approve

Reviewed base bd73490418266f267d9bb3bdf13e64582adc8e80 through exact live head 92f15c042a3e314483bcb5478f9525b81681f2c2, integrating both assigned lanes. No author-actionable defect remains.

Signed event persistence and workflow materialization share one tenant-fenced transaction; every production run-creation seam copies the revision selected with the workflow; legacy writers conservatively clear provenance; and the additive migration avoids false historical attribution. Both lanes independently cleared the ownership, transaction, downgrade, and compatibility boundaries.

Verification and residual risk

Exact-head GitHub checks are green, including PostgreSQL, backend integration, relay E2E, Rust/security, cross-platform, and Desktop gates. Local DB (115 passed) and workflow (169 passed) suites passed. Two relay failures occurred in unchanged telemetry/mesh-demo tests and are not attributed to this PR; exact-head CI is green.

Migration 0043 needs PostgreSQL ACCESS EXCLUSIVE locks and runtime auto-migration has no bounded lock/statement timeout. This is release-owned rollout risk, not author rework: apply schema before new binaries and monitor lock acquisition.

— :bot: Jude’s code review agent

[jedwards27]

Review verdict: approve

Reviewed base b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6 through exact live head d2a80d819979efbf4b02e8b322a425c91c18e046, integrating both assigned review lanes. No author-actionable defect was found.

The migration is correctly resequenced to 0045 and preserves historical provenance as unknown rather than fabricating a revision. Signed workflow persistence and revision binding remain in one tenant-fenced transaction; rebinding occurs under the workflow row lock; and every identified production event, schedule, manual, and webhook run-creation seam copies the revision selected with the loaded definition. Legacy semantic writers conservatively clear provenance, while operational-only writes preserve it. Tests cover migration parity, mixed-version writes, rollback/locking, run stability, and PostgreSQL constraints and no-rewrite behavior.

Verification and residual risk

At this exact head, the PostgreSQL discovery guard, full buzz-db library suite, and full buzz-workflow library suite passed. The full relay library suite produced one unrelated mesh-demo timeout after 1033 passes and 89 ignores; its exact isolated rerun passed. A separate full DB invocation reached 122 passes and 255 ignores before an unchanged observability source gate rejected an existing .fetch_all(pool) call.

GitHub currently reports the exact head and has no failing conclusion, but several checks are still running, including Rust unit/Windows, Desktop, relay-artifact, macOS, and Docker jobs; the PostgreSQL CI job was skipped behind the still-running producer topology. Repository gate owners should require terminal green at this same SHA. Any new head invalidates this approval until its delta is reviewed.

Author action: none.

— :bot: Jude’s code review agent

[jedwards27]

Verdict: APPROVE

Reviewed: b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6..d2a80d819979efbf4b02e8b322a425c91c18e046 (exact head d2a80d819979efbf4b02e8b322a425c91c18e046)

Risk: high — additive PostgreSQL migration, signed workflow provenance, mixed-version writers, tenant-bound materialization, and revision propagation into every run-creation path.

Behavior/contracts traced: signed kind-30620 event persistence; transaction and row-lock boundaries; community/owner identity; materialized workflow rebinding; event/schedule/manual/webhook run creation; historical NULL semantics; legacy equal/different semantic writes; operational-only writes; rollback/re-upgrade; migration lineage 0045; desired-schema parity; relation-lock and rollout behavior; stack-child compatibility.

Findings: no unresolved author-actionable defect. The prior-reviewed behavior remains intact after rebasing and moving the migration behind occupied slots 0043/0044. Signed definition persistence and materialized revision binding share one transaction; rebinding occurs under the workflow row lock. All production create_workflow_run seams found in repository-wide Rust search copy the revision selected with the loaded definition. Legacy semantic writes conservatively clear provenance—including equal-value writes—while operational enable/status changes preserve it. Existing runs retain their captured revision, and historical rows remain truthfully unknown (NULL) rather than acquiring inferred provenance.

Author action: none.

Verification owner: repository CI/release owners for still-running exact-head checks and controlled schema-first rollout; no code rework unless a concrete PR-caused gate failure appears.

Validation at matching exact head: both assigned lanes used clean detached d2a80d819979efbf4b02e8b322a425c91c18e046 trees; git diff --check passed. PostgreSQL test-discovery guard passed. Full buzz-db --lib passed 122 tests with 255 ignored; full buzz-workflow --lib passed 169 with 2 ignored. Full buzz-relay --lib passed 1,033 with 89 ignored except one unrelated mesh-demo timeout; its isolated exact-head rerun passed 1/1 in 0.13s. Migration integration coverage applies 0045 to populated legacy tables and verifies historical NULLs, NOT VALID constraints, unchanged relation file IDs, valid/invalid writes, preservation, invalidation, locking, rollback, and run-copy stability.

Manual/native evidence: not applicable; this foundation slice changes persistence/runtime contracts without renderer UI.

Residual risk: exact-head CI was still completing at lane close. Migration DDL requires PostgreSQL relation locks and runtime opt-in migration has unbounded lock/statement timeouts; the PR documents schema-first controlled application. This is release/DB-operations-owned rollout risk, not an author-actionable code defect.

— :bot: Jude’s code review agent