PostgreSQL data-authority foundation

The versioned production Stack declares PostgreSQL as the Agent Runtime v1 metadata, cursor, audit, and outbox authority. The reviewed runtime migrations create the normalized storage foundation for tenants, immutable Agent revision metadata, Sessions, content-referenced Inputs, Turns, ordered Product events, audit facts, and a durable publication/reconciliation outbox.

The migration stores only bounded metadata and immutable content references: digests, media types, and byte counts. It deliberately has no raw prompt, Input-body, or Product-event body columns. The declared blob authority owns content bytes; PostgreSQL owns authorization-scoped indexes, state, order, and retention metadata.

The repository’s data lifecycle reference defines the independently configurable retention classes for state metadata, events, audit facts, outbox, receipts, payload blobs, and sandbox records.

Its database constraints establish the initial mechanical guards:

every runtime row is scoped by its tenant, and Session records are additionally scoped by principal;
Agent revisions, Sessions, Inputs, and Turns retain their typed runtime identities and ordered relationships;
each Session event has one unique ordered sequence, Cursor, and event ID;
audit facts deduplicate an operation identity within a tenant; and
outbox records are unique for one aggregate version and event kind, with bounded reference payload metadata.

The v2 and v3 upgrade artifacts, their forward-only refusal artifacts, and their SHA-256 digests are declared in deploy/production/stack.json. An upgrade takes a PostgreSQL transaction advisory lock and verifies both its versioned migration fingerprint and the required physical schema before it reports success. This prevents IF NOT EXISTS from silently accepting a partial or different schema. The refusal artifacts never drop data: recovery from a bad deployment requires an operator-approved PostgreSQL backup/PITR procedure, not an automatic rollback. This repository does not yet contain a backup/PITR runbook or a retained restore drill, so that recovery path remains unproven. Migrations are applied only by an explicit audited Stack operator action; runtime processes have no DDL authority. Disposable PostgreSQL integration tests execute the artifacts and prove the declared constraints.

Internal admission adapter (not the public API)

The repository contains an internal first-admission adapter used only by direct application composition and real PostgreSQL integration tests. It accepts an already-authorized, pre-existing Session; validates each Artifact reference against that owner’s exact state-recorded ID, digest, media type, and size before staging; persists immutable content references rather than raw Input parts; and atomically records the Input, Turn, bounded facts, audit record, and outbox record. The disposable PostgreSQL/MinIO proof restarts this composition before admitting the reference and rejects both forged metadata and a different principal with the same safe not_found result. The first Turn for an idle Session is marked running; later Turns are marked queued. Its narrow transaction also serializes identical owner/idempotency-key admissions so a conflicting Session is refused rather than surfacing a database uniqueness failure.

This is not a public HTTP or Go SDK route, and it does not change the public runtime’s memory-unsafe store. The composition test uses a real immutable object-store adapter, but it is not yet Artifact transfer/streaming evidence or a production blob authorization plane. The outbox is transactionally recorded only: publication, retry/reconciliation, and restart recovery are not responsibilities of this first-admission adapter.

Separate private integration evidence exercises two recovery paths against disposable PostgreSQL, MinIO, and Temporal dependencies. The outbox publisher reclaims a lease when its acknowledgement is lost only after Temporal accepts the same route. The model-effect worker recreates its PostgreSQL composition after a lost claimed producer intent, reconciles the original operation rather than invoking it again, records an ordered producer.gap and turn.failed, and replays those Product events from the durable public cursor. Neither test adds a public provider streaming API, a provider-specific adapter, or a production blob authorization plane.

The current schema is not yet an RLS or database-role authorization boundary. The future production adapter must add tenant RLS policy, role grants, and a least-privilege migration/runtime credential split before it uses these tables for public requests.