Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

infrastructure/database/alembic/env.py

@@ -0,0 +1,53 @@
+"""Alembic environment for the Hub database, never the ContextForge database."""
+
+from __future__ import annotations
+
+import os
+from logging.config import fileConfig
+
+from alembic import context
+from sqlalchemy import engine_from_config, pool
+
+from services.control_api.persistence.models import Base
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+database_url = os.environ.get("HUB_DATABASE_URL") or os.environ.get("DATABASE_URL")
+if database_url:
+    config.set_main_option("sqlalchemy.url", database_url.replace("%", "%%"))
+
+target_metadata = Base.metadata
+
+
+def run_migrations_offline() -> None:
+    url = config.get_main_option("sqlalchemy.url")
+    context.configure(
+        url=url,
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+        compare_type=True,
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def run_migrations_online() -> None:
+    connectable = engine_from_config(
+        config.get_section(config.config_ini_section, {}),
+        prefix="sqlalchemy.",
+        poolclass=pool.NullPool,
+        future=True,
+    )
+    with connectable.connect() as connection:
+        context.configure(connection=connection, target_metadata=target_metadata, compare_type=True)
+        with context.begin_transaction():
+            context.run_migrations()
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

infrastructure/database/alembic/versions/0001_core_schema.py

@@ -0,0 +1,44 @@
+"""Create the Hub control-plane schema.
+
+The metadata is deliberately Hub-only.  ContextForge has its own database and
+its tables must never be imported into this migration.
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+from services.control_api.persistence.models import Base
+
+revision = "0001_core_schema"
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    Base.metadata.create_all(bind=bind, checkfirst=True)
+    if bind.dialect.name == "postgresql":
+        op.execute(
+            """
+            CREATE OR REPLACE FUNCTION hub_prevent_audit_mutation()
+            RETURNS trigger LANGUAGE plpgsql AS $$
+            BEGIN
+                RAISE EXCEPTION 'audit_events are append-only';
+            END;
+            $$;
+            DROP TRIGGER IF EXISTS trg_audit_events_append_only ON audit_events;
+            CREATE TRIGGER trg_audit_events_append_only
+            BEFORE UPDATE OR DELETE ON audit_events
+            FOR EACH ROW EXECUTE FUNCTION hub_prevent_audit_mutation();
+            """
+        )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        op.execute("DROP TRIGGER IF EXISTS trg_audit_events_append_only ON audit_events")
+        op.execute("DROP FUNCTION IF EXISTS hub_prevent_audit_mutation()")
+    Base.metadata.drop_all(bind=bind, checkfirst=True)

infrastructure/database/alembic/versions/0002_knowledge_search.py

@@ -0,0 +1,38 @@
+"""Add PostgreSQL lexical search indexes for project knowledge."""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0002_knowledge_search"
+down_revision = "0001_core_schema"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name != "postgresql":
+        return
+    op.execute("CREATE EXTENSION IF NOT EXISTS pg_trgm")
+    op.execute(
+        "CREATE INDEX IF NOT EXISTS ix_knowledge_chunks_text_fts "
+        "ON knowledge_chunks USING gin (to_tsvector('simple', text))"
+    )
+    op.execute(
+        "CREATE INDEX IF NOT EXISTS ix_knowledge_documents_title_trgm "
+        "ON knowledge_documents USING gin (title gin_trgm_ops)"
+    )
+    op.execute(
+        "CREATE INDEX IF NOT EXISTS ix_knowledge_documents_external_ref_trgm "
+        "ON knowledge_documents USING gin (external_ref gin_trgm_ops)"
+    )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name != "postgresql":
+        return
+    op.execute("DROP INDEX IF EXISTS ix_knowledge_chunks_text_fts")
+    op.execute("DROP INDEX IF EXISTS ix_knowledge_documents_title_trgm")
+    op.execute("DROP INDEX IF EXISTS ix_knowledge_documents_external_ref_trgm")

infrastructure/database/alembic/versions/0003_policy_trace.py

@@ -0,0 +1,33 @@
+"""Persist explainable policy traces for decisions and invocation audit events."""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy import inspect
+
+revision = "0003_policy_trace"
+down_revision = "0002_knowledge_search"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    inspector = inspect(op.get_bind())
+    if "decision_trace" not in {
+        column["name"] for column in inspector.get_columns("policy_decisions")
+    }:
+        op.add_column(
+            "policy_decisions",
+            sa.Column("decision_trace", sa.JSON(), nullable=False, server_default="[]"),
+        )
+    if "policy_trace" not in {column["name"] for column in inspector.get_columns("audit_events")}:
+        op.add_column(
+            "audit_events",
+            sa.Column("policy_trace", sa.JSON(), nullable=False, server_default="[]"),
+        )
+
+
+def downgrade() -> None:
+    op.drop_column("audit_events", "policy_trace")
+    op.drop_column("policy_decisions", "decision_trace")

infrastructure/database/alembic/versions/0004_audit_retention.py

@@ -0,0 +1,25 @@
+"""Persist the bounded retention deadline emitted by the governance audit lifecycle."""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy import inspect
+
+revision = "0004_audit_retention"
+down_revision = "0003_policy_trace"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    columns = {column["name"] for column in inspect(op.get_bind()).get_columns("audit_events")}
+    if "retention_until" not in columns:
+        op.add_column(
+            "audit_events",
+            sa.Column("retention_until", sa.DateTime(timezone=True), nullable=True),
+        )
+
+
+def downgrade() -> None:
+    op.drop_column("audit_events", "retention_until")