feat(ql3): atomically withdraw quarantined automation

packages/ql3-cluster-postgres/src/schema/schema.ts

@@ -1707,6 +1707,24 @@ export const pluginPackageLifecyclePlans = ql3Schema.table(
   ],
 );
 
+export const pluginPackageAutomationDispositionEvents = ql3Schema.table(
+  'plugin_package_automation_disposition_events',
+  {
+    eventDigest: char('event_digest', { length: 64 }).primaryKey(),
+    eventKind: varchar('event_kind', { length: 16 }).notNull(),
+  },
+  (table) => [
+    check(
+      'ql3_plugin_package_automation_disposition_kind_check',
+      sql`${table.eventKind} in ('lifecycle','quarantine')`,
+    ),
+    check(
+      'ql3_plugin_package_automation_disposition_digest_check',
+      sql`${table.eventDigest} ~ '^[0-9a-f]{64}$'`,
+    ),
+  ],
+);
+
 export const pluginPackageAutomationPublications = ql3Schema.table(
   'plugin_package_automation_publications',
   {
@@ -1743,9 +1761,9 @@ export const pluginPackageAutomationPublications = ql3Schema.table(
       foreignColumns: [table.publicationDigest],
     }).onDelete('restrict'),
     foreignKey({
-      name: 'ql3_plugin_package_automation_publication_lifecycle_fk',
+      name: 'ql3_plugin_package_automation_publication_disposition_fk',
       columns: [table.lifecycleEventDigest],
-      foreignColumns: [pluginPackageLifecycleEvents.eventDigest],
+      foreignColumns: [pluginPackageAutomationDispositionEvents.eventDigest],
     }).onDelete('restrict'),
     uniqueIndex('ql3_plugin_package_automation_publication_version_key').on(
       table.projectId,
@@ -5653,9 +5671,11 @@ export const pluginPackageWorkflowTaskAttemptAdmissions = ql3Schema.table(
     uniqueIndex(
       'plugin_package_workflow_task_attempt_admissions_event_id_key',
     ).on(table.eventId),
-    uniqueIndex(
-      'plugin_package_workflow_task_attempt_admissions_epoch_key',
-    ).on(table.runId, table.stepRunId, table.stepRunVersion),
+    uniqueIndex('plugin_package_workflow_task_attempt_admissions_epoch_key').on(
+      table.runId,
+      table.stepRunId,
+      table.stepRunVersion,
+    ),
     uniqueIndex(
       'plugin_package_workflow_task_attempt_admissions_number_key',
     ).on(table.runId, table.attemptNumber),
@@ -5684,10 +5704,7 @@ export const pluginPackageWorkflowTaskAttemptAdmissions = ql3Schema.table(
     }).onDelete('restrict'),
     foreignKey({
       name: 'ql3_pp_workflow_task_attempt_reconciliation_fk',
-      columns: [
-        table.generationDigest,
-        table.taskReconciliationReceiptDigest,
-      ],
+      columns: [table.generationDigest, table.taskReconciliationReceiptDigest],
       foreignColumns: [
         pluginPackageTaskReconciliations.generationDigest,
         pluginPackageTaskReconciliations.receiptDigest,
@@ -5724,9 +5741,11 @@ export const pluginPackageWorkflowTaskAttemptAdmissions = ql3Schema.table(
       'ql3_plugin_package_workflow_task_attempt_admission_json_check',
       sql`jsonb_typeof(${table.receiptJson}) = 'object' and octet_length(${table.receiptJson}::text) between 2 and 16384 and ${table.receiptJson} @> jsonb_build_object('schema', 'qinglong/plugin-package-workflow-task-attempt-admission@v1', 'receiptDigest', ${table.receiptDigest}, 'attemptId', ${table.attemptId}, 'planDigest', ${table.planDigest}, 'runId', ${table.runId}, 'stepRunId', ${table.stepRunId}, 'stepRunVersion', ${table.stepRunVersion}, 'stepRunDigest', ${table.stepRunDigest}, 'resourceTaskId', ${table.resourceTaskId}, 'taskReconciliationReceiptDigest', ${table.taskReconciliationReceiptDigest}, 'taskId', ${table.taskId}, 'taskRevision', ${table.taskRevision}, 'taskDefinitionDigest', ${table.taskDefinitionDigest}, 'executorType', ${table.executorType}, 'executionDigest', ${table.executionDigest}, 'attemptNumber', ${table.attemptNumber}, 'eventId', ${table.eventId}, 'runVersion', ${table.runVersion}, 'runEventSequence', ${table.runEventSequence}, 'admittedAtMs', ${table.admittedAtMs})`,
     ),
-    index(
-      'ql3_pp_workflow_task_attempt_candidate_idx',
-    ).on(table.runId, table.stepRunId, table.admittedAtMs),
+    index('ql3_pp_workflow_task_attempt_candidate_idx').on(
+      table.runId,
+      table.stepRunId,
+      table.admittedAtMs,
+    ),
   ],
 );
 
@@ -5803,6 +5822,7 @@ export const ql3PostgresTables = [
   pluginPackageLifecycleReceipts,
   pluginPackageLifecycleTasks,
   pluginPackageLifecyclePlans,
+  pluginPackageAutomationDispositionEvents,
   pluginPackageAutomationPublications,
   pluginPackageAutomationPublicationHeads,
   pluginPackageWorkflowAdmissions,

packages/ql3-cluster-postgres/src/schema/schemaContract.ts

@@ -15,8 +15,8 @@ export interface PostgresSchemaContractFunction {
 export interface PostgresSchemaContract {
   readonly schema: 'ql3';
   readonly contractName: 'control-core';
-  readonly contractVersion: 56;
-  readonly migrationId: 'pg-0057-run-management-stop-boundary';
+  readonly contractVersion: 57;
+  readonly migrationId: 'pg-0058-plugin-package-automation-disposition-events';
   readonly minimumServerMajor: 16;
   readonly maximumServerMajor: 18;
   readonly capabilities: Readonly<{
@@ -44,6 +44,7 @@ export interface PostgresSchemaContract {
     plugin_package_admission: 1;
     plugin_package_authority_split: 1;
     plugin_package_automation_publication: 1;
+    plugin_package_automation_security_withdrawal: 1;
     plugin_package_automation_start_guard: 1;
     plugin_package_workflow_admission: 1;
     plugin_package_workflow_run_list: 1;
@@ -103,8 +104,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
   Object.freeze({
     schema: 'ql3',
     contractName: 'control-core',
-    contractVersion: 56,
-    migrationId: 'pg-0057-run-management-stop-boundary',
+    contractVersion: 57,
+    migrationId: 'pg-0058-plugin-package-automation-disposition-events',
     minimumServerMajor: 16,
     maximumServerMajor: 18,
     capabilities: Object.freeze({
@@ -125,6 +126,7 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       plugin_package_admission: 1,
       plugin_package_authority_split: 1,
       plugin_package_automation_publication: 1,
+      plugin_package_automation_security_withdrawal: 1,
       plugin_package_automation_start_guard: 1,
       plugin_package_workflow_admission: 1,
       plugin_package_workflow_run_list: 1,
@@ -382,6 +384,10 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
         'expires_at_ms',
         'plan_json',
       ]),
+      table('plugin_package_automation_disposition_events', [
+        'event_digest',
+        'event_kind',
+      ]),
       table('plugin_package_automation_publications', [
         'publication_digest',
         'project_id',
@@ -1445,6 +1451,7 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_lifecycle_plan_impact_key',
       'ql3_plugin_package_lifecycle_plan_expiry_idx',
       'plugin_package_automation_publications_pkey',
+      'plugin_package_automation_disposition_events_pkey',
       'ql3_plugin_package_automation_publication_version_key',
       'ql3_plugin_package_automation_publication_previous_key',
       'ql3_plugin_package_automation_publication_generation_idx',
@@ -1736,6 +1743,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_automation_publication_digest_check',
       'ql3_plugin_package_automation_publication_json_check',
       'ql3_plugin_package_automation_publication_head_state_check',
+      'ql3_plugin_package_automation_disposition_kind_check',
+      'ql3_plugin_package_automation_disposition_digest_check',
       'ql3_plugin_package_workflow_admission_identity_check',
       'ql3_plugin_package_workflow_admission_digest_check',
       'ql3_plugin_package_workflow_admission_json_check',
@@ -2175,7 +2184,7 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_lifecycle_plan_install_fk',
       'ql3_plugin_package_automation_publication_revision_fk',
       'ql3_plugin_package_automation_publication_previous_fk',
-      'ql3_plugin_package_automation_publication_lifecycle_fk',
+      'ql3_plugin_package_automation_publication_disposition_fk',
       'ql3_plugin_package_automation_publication_head_publication_fk',
       'ql3_plugin_package_workflow_admission_run_fk',
       'ql3_plugin_package_workflow_admission_publication_fk',
@@ -2302,6 +2311,14 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_run_retry_policies_run_fk',
     ]),
     functions: Object.freeze([
+      Object.freeze({
+        name: 'register_plugin_package_automation_disposition_event',
+        identityArguments: '',
+        owner: 'ql3_migration',
+        securityDefiner: true,
+        volatility: 'volatile',
+        configuration: Object.freeze(['search_path=pg_catalog, ql3']),
+      }),
       Object.freeze({
         name: 'enforce_plugin_package_stage_provenance',
         identityArguments: '',

packages/ql3-cluster-postgres/src/schema/schemaReadiness.ts

@@ -233,6 +233,12 @@ const REQUIRED_RUNTIME_PRIVILEGES = Object.freeze({
     update: false,
     delete: false,
   }),
+  plugin_package_automation_disposition_events: Object.freeze({
+    select: false,
+    insert: false,
+    update: false,
+    delete: false,
+  }),
   plugin_package_automation_publication_heads: Object.freeze({
     select: true,
     insert: false,
@@ -740,6 +746,12 @@ const REQUIRED_ADMIN_PRIVILEGES = Object.freeze({
     update: false,
     delete: false,
   }),
+  plugin_package_automation_disposition_events: Object.freeze({
+    select: false,
+    insert: false,
+    update: false,
+    delete: false,
+  }),
   plugin_package_automation_publication_heads: Object.freeze({
     select: false,
     insert: false,
@@ -1492,6 +1504,7 @@ const REQUIRED_RUNTIME_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges =
     plugin_package_lifecycle_blocking_runs: false,
     plugin_package_run_start_allowed: true,
     plugin_package_tool_start_allowed: true,
+    register_plugin_package_automation_disposition_event: false,
   });
 
 const REQUIRED_PACKAGE_MANAGER_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges =
@@ -1509,6 +1522,7 @@ const REQUIRED_PACKAGE_MANAGER_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges =
     plugin_package_lifecycle_blocking_runs: false,
     plugin_package_run_start_allowed: false,
     plugin_package_tool_start_allowed: false,
+    register_plugin_package_automation_disposition_event: false,
   });
 
 const REQUIRED_PACKAGE_EXECUTOR_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges =
@@ -1526,6 +1540,7 @@ const REQUIRED_PACKAGE_EXECUTOR_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges
     plugin_package_lifecycle_blocking_runs: true,
     plugin_package_run_start_allowed: false,
     plugin_package_tool_start_allowed: false,
+    register_plugin_package_automation_disposition_event: false,
   });
 
 const REQUIRED_WORKER_CREDENTIAL_FUNCTION_PRIVILEGES: RequiredFunctionPrivileges =