feat(ql3): operationalize cancellation rearm

packages/ql3-cluster-postgres/test/postgresqlSchemaReadiness.test.cjs

@@ -527,6 +527,7 @@ function runManagerPrivileges() {
     'runs',
     'run_attempts',
     'run_events',
+    'run_cancellation_dispatches',
     'security_audit_events',
     'plugin_package_identity_keyset_ledger',
   ]);
@@ -781,19 +782,36 @@ function queryable(overrides = {}) {
         };
       }
       if (text.includes('has_column_privilege')) {
-        assert.match(text, /format\('%I\.%I', \$1::text, 'runs'\)/);
+        const dispatchManagement = text.includes(
+          "format('%I.%I', $1::text, 'run_cancellation_dispatches')",
+        );
+        const tableName = dispatchManagement
+          ? 'run_cancellation_dispatches'
+          : 'runs';
+        assert.match(
+          text,
+          new RegExp(
+            `format\\('%I\\.%I', \\$1::text, '${tableName}'\\)`,
+          ),
+        );
         const columns = contract.tables.find(
-          ({ name }) => name === 'runs',
+          ({ name }) => name === tableName,
         ).columns;
-        const allowed = new Set([
-          'cancel_requested_at_ms',
-          'cancel_reason',
-          'version',
-          'event_sequence',
-        ]);
+        const allowed = new Set(
+          dispatchManagement
+            ? ['status', 'version', 'next_attempt_at_ms', 'updated_at_ms']
+            : [
+                'cancel_requested_at_ms',
+                'cancel_reason',
+                'version',
+                'event_sequence',
+              ],
+        );
         return {
           rows:
-            overrides.runManagerColumnPrivileges ??
+            (dispatchManagement
+              ? overrides.runManagerDispatchColumnPrivileges
+              : overrides.runManagerColumnPrivileges) ??
             columns.map((columnName) => ({
               columnName,
               updateAllowed: allowed.has(columnName),
@@ -817,7 +835,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
     serverMajor: 16,
     currentUser: 'ql3_runtime',
     contractName: 'control-core',
-    contractVersion: 65,
+    contractVersion: 66,
     migrationIds: [
       'pg-0001-schema-capability',
       'pg-0002-run-core',
@@ -885,6 +903,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
       'pg-0064-plugin-package-secret-binding-transition-approval-plans',
       'pg-0065-approved-action-manual-recovery',
       'pg-0066-cancellation-dispatch',
+      'pg-0067-cancellation-dispatch-management',
     ],
   });
 });
@@ -915,10 +934,10 @@ test('accepts the exact schema and isolated least-privilege admin role', async (
     }),
   );
   assert.equal(report.currentUser, 'ql3_admin');
-  assert.equal(report.contractVersion, 65);
+  assert.equal(report.contractVersion, 66);
   assert.equal(
     report.migrationIds.at(-1),
-    'pg-0066-cancellation-dispatch',
+    'pg-0067-cancellation-dispatch-management',
   );
 });
 
@@ -931,10 +950,10 @@ test('accepts the isolated least-privilege automation manager role', async () =>
     }),
   );
   assert.equal(report.currentUser, 'ql3_automation_manager');
-  assert.equal(report.contractVersion, 65);
+  assert.equal(report.contractVersion, 66);
   assert.equal(
     report.migrationIds.at(-1),
-    'pg-0066-cancellation-dispatch',
+    'pg-0067-cancellation-dispatch-management',
   );
 
   const widened = automationManagerPrivileges();
@@ -963,10 +982,10 @@ test('accepts the isolated least-privilege human Approval manager role', async (
     }),
   );
   assert.equal(report.currentUser, 'ql3_approval_manager');
-  assert.equal(report.contractVersion, 65);
+  assert.equal(report.contractVersion, 66);
   assert.equal(
     report.migrationIds.at(-1),
-    'pg-0066-cancellation-dispatch',
+    'pg-0067-cancellation-dispatch-management',
   );
 
   const widened = approvalManagerPrivileges();
@@ -997,10 +1016,10 @@ test('accepts the isolated least-privilege Run manager role', async () => {
     }),
   );
   assert.equal(report.currentUser, 'ql3_run_manager');
-  assert.equal(report.contractVersion, 65);
+  assert.equal(report.contractVersion, 66);
   assert.equal(
     report.migrationIds.at(-1),
-    'pg-0066-cancellation-dispatch',
+    'pg-0067-cancellation-dispatch-management',
   );
 
   const widened = runManagerPrivileges();
@@ -1045,6 +1064,35 @@ test('accepts the isolated least-privilege Run manager role', async () => {
       error.code === 'run_manager_role_invalid' &&
       error.facts.includes('column-update-privilege:runs.status'),
   );
+
+  const widenedDispatchColumns = postgresqlControlSchemaContract.tables
+    .find(({ name }) => name === 'run_cancellation_dispatches')
+    .columns.map((columnName) => ({
+      columnName,
+      updateAllowed: [
+        'status',
+        'version',
+        'next_attempt_at_ms',
+        'updated_at_ms',
+        'lease_token_digest',
+      ].includes(columnName),
+    }));
+  await assert.rejects(
+    assertPostgresRunManagerSchemaReady(
+      queryable({
+        currentUser: 'ql3_run_manager',
+        privileges: runManagerPrivileges(),
+        functionMode: 'run-manager',
+        runManagerDispatchColumnPrivileges: widenedDispatchColumns,
+      }),
+    ),
+    (error) =>
+      error instanceof PostgresSchemaReadinessError &&
+      error.code === 'run_manager_role_invalid' &&
+      error.facts.includes(
+        'column-update-privilege:run_cancellation_dispatches.lease_token_digest',
+      ),
+  );
 });
 
 test('accepts isolated Package manager and executor roles', async () => {
@@ -1132,10 +1180,10 @@ test('accepts the exact schema and isolated Worker ingress role', async () => {
     }),
   );
   assert.equal(report.currentUser, 'ql3_worker_ingress');
-  assert.equal(report.contractVersion, 65);
+  assert.equal(report.contractVersion, 66);
   assert.equal(
     report.migrationIds.at(-1),
-    'pg-0066-cancellation-dispatch',
+    'pg-0067-cancellation-dispatch-management',
   );
 });