176 lines
14 KiB
PL/PgSQL
176 lines
14 KiB
PL/PgSQL
-- Fresh-only enrollment of the reviewed bounded poll journal. No historical backfill.
|
|
-- Fixed logical quota; physical heap/index/WAL and vacuum remain independent.
|
|
-- Requires the empty 0038 poll journal. No scheduling or public activation.
|
|
BEGIN;
|
|
LOCK TABLE server_poll_executions,server_poll_intents,server_poll_acks,server_poll_receipts,server_poll_quarantines IN ACCESS EXCLUSIVE MODE;
|
|
DO $$ BEGIN
|
|
IF EXISTS(SELECT 1 FROM server_poll_executions) OR EXISTS(SELECT 1 FROM server_poll_intents)
|
|
OR EXISTS(SELECT 1 FROM server_poll_acks) OR EXISTS(SELECT 1 FROM server_poll_receipts)
|
|
OR EXISTS(SELECT 1 FROM server_poll_quarantines)
|
|
THEN RAISE EXCEPTION 'nonempty poll journal needs explicit reconciliation'; END IF;
|
|
IF NOT EXISTS(SELECT 1 FROM mcp_settings WHERE id=1 AND requests_retention_days BETWEEN 1 AND 365)
|
|
THEN RAISE EXCEPTION 'poll retention unavailable'; END IF;
|
|
IF EXISTS(SELECT 1 FROM pg_catalog.pg_class WHERE relname IN('server_poll_storage_usage','server_poll_storage_admissions'))
|
|
OR EXISTS(SELECT 1 FROM pg_catalog.pg_proc WHERE proname IN('server_poll_storage_gc_allowed','server_poll_storage_admission_guard','server_poll_storage_row_guard','server_poll_storage_row_meter'))
|
|
OR EXISTS(SELECT 1 FROM pg_catalog.pg_trigger WHERE tgname LIKE 'server_poll_storage_%')
|
|
THEN RAISE EXCEPTION 'unmarked poll storage requires explicit reconciliation'; END IF;
|
|
END $$;
|
|
CREATE TABLE server_poll_storage_usage (
|
|
scope text PRIMARY KEY CHECK(scope='global' OR(scope LIKE 'owner:%' AND length(scope) BETWEEN 7 AND 206)),
|
|
admissions bigint NOT NULL DEFAULT 0 CHECK(admissions>=0 AND admissions<=128),
|
|
reserved_rows bigint NOT NULL DEFAULT 0 CHECK(reserved_rows=admissions*4019),
|
|
reserved_bytes bigint NOT NULL DEFAULT 0 CHECK(reserved_bytes=admissions*8421376),
|
|
CHECK(scope='global' OR admissions<=8)
|
|
);
|
|
CREATE TABLE server_poll_storage_admissions (
|
|
receipt_id uuid PRIMARY KEY, identity_kind text NOT NULL CHECK(identity_kind IN('mcp','rest')),
|
|
execution_id uuid NOT NULL, connection_id uuid, owner_id text NOT NULL CHECK(length(owner_id) BETWEEN 1 AND 200 AND btrim(owner_id)=owner_id AND owner_id !~ '[[:cntrl:]]'),
|
|
binding_proof text NOT NULL CHECK(binding_proof ~ '^[a-f0-9]{64}$'), context_proof text NOT NULL CHECK(context_proof ~ '^[a-f0-9]{64}$'),
|
|
authority_issued_at timestamptz NOT NULL CHECK(isfinite(authority_issued_at)),
|
|
authority_expires_at timestamptz NOT NULL CHECK(isfinite(authority_expires_at) AND authority_expires_at>authority_issued_at),
|
|
max_stages integer NOT NULL CHECK(max_stages BETWEEN 8 AND 2008),
|
|
claim_token uuid, claim_attempted_at timestamptz, created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
retention_days integer NOT NULL CHECK(retention_days BETWEEN 1 AND 365),
|
|
safety_ms integer NOT NULL DEFAULT 60000 CHECK(safety_ms=60000),
|
|
gc_not_before timestamptz NOT NULL CHECK(isfinite(gc_not_before)),
|
|
used_rows integer NOT NULL DEFAULT 0 CHECK(used_rows BETWEEN 0 AND 4019 AND used_rows<=max_stages*2+3),
|
|
used_bytes bigint NOT NULL DEFAULT 0 CHECK(used_bytes BETWEEN 0 AND 8388608),
|
|
UNIQUE(identity_kind,execution_id),
|
|
CHECK((identity_kind='mcp' AND connection_id IS NOT NULL) OR(identity_kind='rest' AND connection_id IS NULL)),
|
|
CHECK((claim_token IS NOT NULL AND claim_attempted_at IS NULL) OR(claim_token IS NULL AND claim_attempted_at IS NOT NULL)),
|
|
CHECK(gc_not_before>=authority_expires_at+make_interval(days=>retention_days)+interval '60 seconds')
|
|
);
|
|
CREATE INDEX server_poll_storage_expiry ON server_poll_storage_admissions(gc_not_before,receipt_id);
|
|
INSERT INTO server_poll_storage_usage(scope) VALUES('global');
|
|
|
|
-- Every guard is installed in this same empty-enrollment transaction;
|
|
-- no historical admission or journal identity is inferred or imported.
|
|
CREATE FUNCTION server_poll_storage_gc_allowed(id uuid) RETURNS boolean LANGUAGE plpgsql SET TimeZone='UTC' AS $$
|
|
DECLARE a server_poll_storage_admissions%ROWTYPE; retention integer; activity timestamptz; terminal_at timestamptz;
|
|
BEGIN
|
|
IF current_setting('mm.poll_storage_gc',true) IS DISTINCT FROM 'on' THEN RETURN false; END IF;
|
|
PERFORM pg_advisory_xact_lock(hashtextextended('server-poll-storage-v1',0));
|
|
SELECT * INTO a FROM server_poll_storage_admissions WHERE receipt_id=id FOR UPDATE;
|
|
IF NOT FOUND OR a.authority_expires_at>=clock_timestamp() OR a.gc_not_before>=clock_timestamp() THEN RETURN false; END IF;
|
|
SELECT requests_retention_days INTO retention FROM mcp_settings WHERE mcp_settings.id=1 FOR SHARE;
|
|
IF retention IS NULL OR retention NOT BETWEEN 1 AND 365 THEN RETURN false; END IF;
|
|
terminal_at:=a.created_at;
|
|
IF a.identity_kind='mcp' THEN
|
|
SELECT GREATEST(o.finished_at,p.expires_at) INTO terminal_at FROM mcp_operations o
|
|
JOIN mcp_plans p ON p.id=o.plan_id AND p.connection_id=o.connection_id
|
|
JOIN mcp_connections c ON c.id=o.connection_id
|
|
WHERE o.id=a.execution_id AND o.connection_id=a.connection_id AND c.owner_id=a.owner_id AND p.operation_id='servers.poll'
|
|
AND o.state IN('applied','failed','unknown','rejected','partial','cancelled') AND o.finished_at IS NOT NULL
|
|
FOR UPDATE OF o,p,c;
|
|
IF NOT FOUND OR terminal_at IS NULL THEN RETURN false; END IF;
|
|
END IF;
|
|
SELECT GREATEST(a.authority_expires_at,a.created_at,COALESCE(a.claim_attempted_at,a.created_at),terminal_at,
|
|
COALESCE((SELECT created_at FROM server_poll_executions WHERE receipt_id=id),a.created_at),
|
|
COALESCE((SELECT max(created_at) FROM server_poll_intents WHERE receipt_id=id),a.created_at),
|
|
COALESCE((SELECT max(created_at) FROM server_poll_acks WHERE receipt_id=id),a.created_at),
|
|
COALESCE((SELECT created_at FROM server_poll_receipts WHERE receipt_id=id),a.created_at),
|
|
COALESCE((SELECT created_at FROM server_poll_quarantines WHERE receipt_id=id),a.created_at)) INTO activity;
|
|
RETURN activity+make_interval(days=>GREATEST(a.retention_days,retention))+a.safety_ms*interval '1 millisecond'<clock_timestamp();
|
|
END $$;
|
|
|
|
CREATE FUNCTION server_poll_storage_admission_guard() RETURNS trigger LANGUAGE plpgsql SET TimeZone='UTC' AS $$
|
|
DECLARE retention integer; charged integer;
|
|
BEGIN
|
|
PERFORM pg_advisory_xact_lock(hashtextextended('server-poll-storage-v1',0));
|
|
IF TG_OP='DELETE' THEN
|
|
IF NOT server_poll_storage_gc_allowed(OLD.receipt_id) OR EXISTS(SELECT 1 FROM server_poll_executions WHERE receipt_id=OLD.receipt_id)
|
|
OR EXISTS(SELECT 1 FROM server_poll_intents WHERE receipt_id=OLD.receipt_id) OR EXISTS(SELECT 1 FROM server_poll_acks WHERE receipt_id=OLD.receipt_id)
|
|
OR EXISTS(SELECT 1 FROM server_poll_receipts WHERE receipt_id=OLD.receipt_id) OR EXISTS(SELECT 1 FROM server_poll_quarantines WHERE receipt_id=OLD.receipt_id)
|
|
THEN RAISE EXCEPTION 'poll lifetime or children prevent admission deletion'; END IF;
|
|
UPDATE server_poll_storage_usage SET admissions=admissions-1,reserved_rows=reserved_rows-4019,reserved_bytes=reserved_bytes-8421376
|
|
WHERE scope IN('global','owner:'||OLD.owner_id) AND admissions>=1 AND reserved_rows>=4019 AND reserved_bytes>=8421376;
|
|
GET DIAGNOSTICS charged=ROW_COUNT;
|
|
IF charged<>2 THEN RAISE EXCEPTION 'poll quota refund mismatch'; END IF;
|
|
RETURN OLD;
|
|
END IF;
|
|
IF TG_OP='UPDATE' THEN
|
|
IF(to_jsonb(OLD)-ARRAY['claim_token','claim_attempted_at','used_rows','used_bytes']) IS DISTINCT FROM
|
|
(to_jsonb(NEW)-ARRAY['claim_token','claim_attempted_at','used_rows','used_bytes']) THEN RAISE EXCEPTION 'poll admission identity is immutable'; END IF;
|
|
IF OLD.claim_token IS NOT NULL AND NEW.claim_token IS NULL AND OLD.claim_attempted_at IS NULL AND NEW.claim_attempted_at IS NOT NULL
|
|
AND NEW.used_rows=OLD.used_rows AND NEW.used_bytes=OLD.used_bytes AND OLD.authority_expires_at>clock_timestamp()
|
|
THEN NEW.claim_attempted_at:=clock_timestamp(); RETURN NEW; END IF;
|
|
IF OLD.claim_token IS NOT DISTINCT FROM NEW.claim_token AND OLD.claim_attempted_at IS NOT DISTINCT FROM NEW.claim_attempted_at
|
|
AND NEW.used_rows=OLD.used_rows+1 AND NEW.used_bytes>OLD.used_bytes THEN RETURN NEW; END IF;
|
|
RAISE EXCEPTION 'poll admission cannot refresh, reopen or refund itself';
|
|
END IF;
|
|
SELECT requests_retention_days INTO retention FROM mcp_settings WHERE id=1;
|
|
IF retention IS NULL OR retention NOT BETWEEN 1 AND 365 OR NEW.authority_issued_at>clock_timestamp()
|
|
OR NEW.authority_expires_at<=clock_timestamp() OR NEW.claim_token IS NULL OR NEW.claim_attempted_at IS NOT NULL
|
|
OR NEW.used_rows<>0 OR NEW.used_bytes<>0
|
|
THEN RAISE EXCEPTION 'new poll admission needs original live authority'; END IF;
|
|
IF EXISTS(SELECT 1 FROM server_poll_storage_admissions WHERE receipt_id=NEW.receipt_id OR(identity_kind=NEW.identity_kind AND execution_id=NEW.execution_id))
|
|
THEN RAISE EXCEPTION 'poll identity already spent'; END IF;
|
|
NEW.created_at:=clock_timestamp(); NEW.retention_days:=retention; NEW.safety_ms:=60000;
|
|
NEW.gc_not_before:=NEW.authority_expires_at+make_interval(days=>retention)+interval '60 seconds';
|
|
INSERT INTO server_poll_storage_usage(scope) VALUES('owner:'||NEW.owner_id) ON CONFLICT DO NOTHING;
|
|
IF(SELECT count(*) FROM server_poll_storage_usage WHERE scope IN('global','owner:'||NEW.owner_id)
|
|
AND admissions<CASE WHEN scope='global' THEN 128 ELSE 8 END)<>2 THEN RAISE EXCEPTION 'poll admission quota exhausted'; END IF;
|
|
UPDATE server_poll_storage_usage SET admissions=admissions+1,reserved_rows=reserved_rows+4019,reserved_bytes=reserved_bytes+8421376
|
|
WHERE scope IN('global','owner:'||NEW.owner_id);
|
|
GET DIAGNOSTICS charged=ROW_COUNT; IF charged<>2 THEN RAISE EXCEPTION 'poll admission quota unavailable'; END IF;
|
|
RETURN NEW;
|
|
END $$;
|
|
CREATE TRIGGER server_poll_storage_admission_guard BEFORE INSERT OR UPDATE OR DELETE ON server_poll_storage_admissions
|
|
FOR EACH ROW EXECUTE FUNCTION server_poll_storage_admission_guard();
|
|
|
|
CREATE FUNCTION server_poll_storage_row_guard() RETURNS trigger LANGUAGE plpgsql AS $$
|
|
DECLARE a server_poll_storage_admissions%ROWTYPE; n integer;
|
|
BEGIN
|
|
PERFORM pg_advisory_xact_lock(hashtextextended('server-poll-storage-v1',0));
|
|
SELECT * INTO a FROM server_poll_storage_admissions WHERE receipt_id=NEW.receipt_id FOR UPDATE;
|
|
IF NOT FOUND THEN RAISE EXCEPTION 'poll journal needs a committed admission'; END IF;
|
|
IF TG_TABLE_NAME='server_poll_quarantines' THEN
|
|
IF NEW.identity_kind<>a.identity_kind OR NEW.execution_id<>a.execution_id OR NEW.context_proof<>a.context_proof
|
|
THEN RAISE EXCEPTION 'poll quarantine admission mismatch'; END IF;
|
|
ELSE
|
|
IF a.claim_token IS NOT NULL OR a.claim_attempted_at IS NULL OR a.authority_expires_at<=clock_timestamp()
|
|
THEN RAISE EXCEPTION 'poll admission is not consumed and live'; END IF;
|
|
END IF;
|
|
IF TG_TABLE_NAME='server_poll_executions' THEN
|
|
IF NEW.identity_kind<>a.identity_kind OR NEW.execution_id<>a.execution_id OR NEW.context_proof<>a.context_proof OR NEW.binding_proof<>a.binding_proof
|
|
THEN RAISE EXCEPTION 'poll anchor admission mismatch'; END IF;
|
|
ELSIF TG_TABLE_NAME IN('server_poll_intents','server_poll_acks') THEN
|
|
IF NEW.stage LIKE 'publish.%' AND substring(NEW.stage FROM 9)::integer>=a.max_stages-4 THEN RAISE EXCEPTION 'poll stage exceeds private reservation'; END IF;
|
|
IF TG_TABLE_NAME='server_poll_intents' THEN SELECT count(*) INTO n FROM server_poll_intents WHERE receipt_id=NEW.receipt_id;
|
|
ELSE SELECT count(*) INTO n FROM server_poll_acks WHERE receipt_id=NEW.receipt_id; END IF;
|
|
IF n>=a.max_stages THEN RAISE EXCEPTION 'poll stage row budget exhausted'; END IF;
|
|
END IF;
|
|
IF TG_TABLE_NAME<>'server_poll_quarantines' AND EXISTS(SELECT 1 FROM server_poll_quarantines WHERE receipt_id=NEW.receipt_id)
|
|
THEN RAISE EXCEPTION 'poll identity quarantined'; END IF;
|
|
NEW.created_at:=clock_timestamp();
|
|
RETURN NEW;
|
|
END $$;
|
|
-- Meter actual inserts, not BEFORE attempts: ON CONFLICT DO NOTHING must not
|
|
-- spend another row/byte allowance for a marker which was never inserted.
|
|
CREATE FUNCTION server_poll_storage_row_meter() RETURNS trigger LANGUAGE plpgsql AS $$
|
|
DECLARE cost bigint; n integer;
|
|
BEGIN
|
|
PERFORM pg_advisory_xact_lock(hashtextextended('server-poll-storage-v1',0));
|
|
cost:=pg_column_size(NEW);
|
|
UPDATE server_poll_storage_admissions SET used_rows=used_rows+1,used_bytes=used_bytes+cost
|
|
WHERE receipt_id=NEW.receipt_id AND used_rows<max_stages*2+3 AND used_bytes<=8388608-cost;
|
|
GET DIAGNOSTICS n=ROW_COUNT; IF n<>1 THEN RAISE EXCEPTION 'poll journal byte or row budget exhausted'; END IF;
|
|
RETURN NEW;
|
|
END $$;
|
|
CREATE TRIGGER server_poll_storage_anchor_guard BEFORE INSERT ON server_poll_executions FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_guard();
|
|
CREATE TRIGGER server_poll_storage_intent_guard BEFORE INSERT ON server_poll_intents FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_guard();
|
|
CREATE TRIGGER server_poll_storage_ack_guard BEFORE INSERT ON server_poll_acks FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_guard();
|
|
CREATE TRIGGER server_poll_storage_receipt_guard BEFORE INSERT ON server_poll_receipts FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_guard();
|
|
CREATE TRIGGER server_poll_storage_quarantine_guard BEFORE INSERT ON server_poll_quarantines FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_guard();
|
|
CREATE TRIGGER server_poll_storage_anchor_meter AFTER INSERT ON server_poll_executions FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_meter();
|
|
CREATE TRIGGER server_poll_storage_intent_meter AFTER INSERT ON server_poll_intents FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_meter();
|
|
CREATE TRIGGER server_poll_storage_ack_meter AFTER INSERT ON server_poll_acks FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_meter();
|
|
CREATE TRIGGER server_poll_storage_receipt_meter AFTER INSERT ON server_poll_receipts FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_meter();
|
|
CREATE TRIGGER server_poll_storage_quarantine_meter AFTER INSERT ON server_poll_quarantines FOR EACH ROW EXECUTE FUNCTION server_poll_storage_row_meter();
|
|
CREATE OR REPLACE FUNCTION server_poll_journal_immutable() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN
|
|
IF TG_OP='DELETE' AND server_poll_storage_gc_allowed(OLD.receipt_id) THEN RETURN OLD; END IF;
|
|
RAISE EXCEPTION 'server poll journal is immutable before its full lifetime elapses';
|
|
END $$;
|
|
INSERT INTO schema_migrations(id) VALUES ('0039_server_poll_storage') ON CONFLICT(id) DO NOTHING;
|
|
COMMIT;
|