Skip to content

Persist exact workflow revisions additively - #6960

Draft
loganj wants to merge 5 commits into
mainfrom
larry/workflow-revision-foundation-v4
Draft

Persist exact workflow revisions additively#6960
loganj wants to merge 5 commits into
mainfrom
larry/workflow-revision-foundation-v4

Conversation

@loganj

@loganj loganj commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

🤖
I’m Larry.

Summary

Workflow runs need to record which signed instructions they started with, rather than relying on a definition that can later change. This PR saves that exact revision when a workflow is created or updated and copies it into new runs. It provides the foundation for verifying manual requests and workflow-generated agent messages without changing existing trigger behavior.

The signed definition and its database representation now commit together. During a rolling deployment, an older relay can still rewrite the workflow, but that write clears its revision reference—even when it writes identical values—instead of leaving a misleading reference to an earlier definition. Previously created runs retain the revision they selected.

Related issue

Foundation for owner-authorized manual triggers (#6964) and verified agent mention wakes (#6965).

Originating workstream: buzz://message?channel=11ae68c1-38e7-4591-958e-e4da94d758f0&id=ee768d6e6f981d9450e2afc727a632d99d9480bbbe4399995332c5dd19e12c4c

Compatibility and rollout

  • Migration 0041 adds optional revision references to workflows and runs, validates their length, and invalidates the workflow reference when its stored definition or identity is rewritten. Changes to enabled/status flags preserve it.
  • Existing workflows and historical runs keep an unknown revision (NULL) until new signed ingestion supplies one for the workflow. Existing execution remains compatible with unknown revisions.
  • Matching current content cannot prove which historical event produced it. Automatic historical backfill is excluded; #6963 was retired from this delivery plan, although that PR remains open.
  • This PR adds neither manual-trigger authorization nor agent waking; those are the two dependent slices above.

Testing

At bb7de1e3, the full database, workflow, and relay package suites passed on Blox, with formatting and Clippy. All 11 workflow PostgreSQL regressions passed against both ordered migrations and a fresh desired-schema database, including legacy rewrites, transaction visibility, rollback, and retention of existing run revisions. The permanent backend CI gate also ran the workflow tests from the compiled test archive.

@github-actions

This comment has been minimized.

@loganj
loganj marked this pull request as ready for review August 27, 2026 21:15
@loganj
loganj requested a review from a team as a code owner August 27, 2026 21:15
@loganj
loganj marked this pull request as draft August 28, 2026 16:54
@loganj
loganj force-pushed the larry/workflow-revision-foundation-v4 branch from ca2c16c to e191591 Compare August 28, 2026 16:56
@loganj

This comment has been minimized.

@loganj

This comment has been minimized.

@loganj

This comment has been minimized.

@loganj
loganj force-pushed the larry/workflow-revision-foundation-v4 branch from 53b92fc to 8368014 Compare August 28, 2026 21:01
@loganj

This comment has been minimized.

loganj and others added 5 commits August 28, 2026 17:26
Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Clear bindings at the database materialization boundary, even on equal-value legacy updates. Rebind inside atomic signed ingest while holding the row lock.

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>
Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>
Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>
Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>
@loganj
loganj force-pushed the larry/workflow-revision-foundation-v4 branch from 8368014 to bb7de1e Compare August 28, 2026 21:30
@loganj

This comment has been minimized.

@loganj

This comment has been minimized.

mfethe1 added a commit to mfethe1/buzz that referenced this pull request Aug 29, 2026
…e duplicate-prefix absorb collision

Upstream consumed migration numbers 0035 through 0040 (0035_relay_operators
.. 0040_push_message_kinds) while the fork held 0035_task_system.sql, so the
prospective merged tree carried two files claiming the 0035 prefix -- a
schema-ordering hazard, not a cosmetic one.

Renumber to 0041, the next free number measured against the merged tree with
git ls-tree on both refs immediately before committing (the three open 0041
claimants block#6981/block#6994/block#6960 re-verified unmerged at commit time). The
deliberate 0035-0040 gap is the design: it reserves the range upstream already
owns so the next absorb drops those six files into empty slots with no second
collision.

This supersedes the earlier 0040 target recorded in the prior attempt: block#6269
merged 0040_push_message_kinds.sql 23 minutes after that branch was cut, which
would have recreated the collision one number up.

Zero SQL bytes change (md5 ce760c56f87fb31ae02096a07a96eb04 before and after).
The migration count stays 35 -- this is a renumber, not an addition -- so only
the highest version moves, 35 -> 41, in the task-system assertion.

Signed-off-by: Michael Feth <michael@jira-flow.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant