# Migrate storage from SQLite to PostgreSQL — full dashboard cutover Migrates Fusion's storage layer to the embedded PostgreSQL `AsyncDataLayer` (the default backend) and **completes the satellite-store + feature cutover** so every dashboard and Command Center surface works in PG mode. ## Status — every surface works in embedded-PG mode Verified live against a running embedded-Postgres dashboard (all **200**, zero 5xx) and gate-tested (**23 files / 99 tests** on embedded PG, plus engine-core 294 and ci-shape 63 in the blocking merge gate; core/engine/cli/dashboard typecheck clean). | Area | Surfaces | State | |---|---|---| | Satellite stores | workflows, todos, insights, research, missions, goals, mailbox | ✅ | | Views | artifacts, documents, evals | ✅ | | Command Center | activity, productivity, team, tokens, tools, **workflows**, **github**, **signals**, **plugin-activations**, **live** (all 10) | ✅ | | Run execution | insight generation, research run execution | ✅ (store-path; AI step needs a provider) | | Live updates | SSE push for mission/research/insight events | ✅ | | Workflow editing | create / update / delete / select (+ id counter) | ✅ | | Engine | mission autopilot, incident-signal ingestion, regression storm-guard, agent wake-on-message | ✅ | | Core | tasks, agents, secrets, automations, memory, chat, usage, PRs, git | ✅ | ## Approach Each satellite store gets an `Async<Store>` wrapper exposing the sync store's method names over the existing `async-*-store.ts` helpers; `get<Store>Store()` returns a `Sync | Async` union; consumers `await` (harmless on sync), and engine/CLI paths that can't convert use `instanceof Sync` graceful fallback. Analytics aggregators branch on `"ping" in dbOrLayer` to run schema-qualified raw SQL over `project.*` (snake_case) in PG. Executors/orchestrators/autopilot are await-converted to drive the union store; the async store wrappers extend `EventEmitter` so SSE live-push fires in both backends. Not-yet-ported capabilities degrade gracefully (never 500) and are individually called out in commits. ## Sync with main The branch is kept continuously merged with `main` (currently through FN-7845, 2026-07-12); the earlier "final rebase deferred" note no longer applies. Use **Create a merge commit** (or squash) to land it — GitHub's rebase-merge cannot replay a merge-maintained branch. ## Residual Review Findings Multi-agent code review of the PostgreSQL satellite-store ports (U1–U5) applied 3 safe fixes (see `fix(review): apply autofix feedback`). The following are **real but gated** — recorded here as follow-up work rather than auto-applied. All are SQLite→PostgreSQL **concurrency/atomicity regressions**: the sync stores were immune only by SQLite's single-writer, single-threaded-handler execution; the async ports open multi-await read-modify-write windows. **Reachability is low today** because the execution engines that generate concurrent same-run mutations (insight run executor, research orchestrator/dispatcher) are `instanceof`-gated to sync mode in PG. No process-crash class survived (all engine fallbacks correctly guard the sync store). - **[P1] Research `appendResearchEvent` dual-write is non-atomic** (`packages/core/src/async-research-store.ts`, corroborated: adversarial + reliability). The `research_run_events` insert (own transaction) and the `run.events` jsonb update are separate writes — a crash between them, or two concurrent appends, splits the table count from the jsonb array. **Fix:** perform the seq-insert and the jsonb update in one `layer.transactionImmediate`. - **[P1] Research run terminal-reversion via stale full-row persist** (`async-research-store.ts` `persistResearchRun`/`updateResearchStatus`). Concurrent `PATCH /runs/:id/status` + `POST /runs/:id/events` can revert a terminal run to `running` by overwriting the whole row, bypassing the transition guard. **Fix:** scoped column `UPDATE`s with a `WHERE status …` guard, or optimistic version column. - **[P2] `updateResearchRun`/`updateInsightRun` read-then-write TOCTOU** — concurrent PATCHes last-writer-wins on the lifecycle merge. **Fix:** `SELECT … FOR UPDATE` / enclosing transaction. - **[P2] `upsertRun`/`createRunOrThrowConflict` check-then-create race** (`async-insight-store.ts`) — two callers can each create an "active" run. **Fix:** partial unique index on `(projectId, trigger) WHERE status IN ('pending','running')`. - **[P3] `createResearchRetryRun` return-value divergence** — sync returns the pre-update `queued` snapshot; async returns the reloaded `retry_waiting` run (persisted state is identical). Pick one side for cross-backend parity. - **[P2/perf] Mission `getMissionWithHierarchy`/`getMissionHealth` N+1 fan-out** — O(milestones×slices) sequential round-trips hold one pool slot per request; can starve the pool for large hierarchies. **Fix:** batched/joined reads. - **Testing gaps:** no PG-mode concurrency tests (interleaved status/event mutations), no sync↔async parity assertion for the lifecycle-error codes, and no mission status/health rollup parity test vs the sync `MissionStore`. ~~Out of scope (deferred): AI run *execution* (insight/research) + mission autopilot + live SSE mission events remain sync-gated/degraded in PG mode.~~ **Since ported** — insight/research run execution, mission autopilot, and SSE live push all run on the async layer now, which also makes the concurrency findings above genuinely reachable; they remain open follow-ups. --- ## Update — 2026-07-12: production-readiness hardening & live acceptance Everything below landed on this branch since the description above was written: **Production blockers from review — fixed** - `recoverStaleTransitionPending` ported to the async layer (backend moves write + clear the crash-safe marker; startup/maintenance sweeps no longer throw). - Lost-update class fixed: `atomicWriteTaskJson`/`WithAudit` write changed columns only (full-row upserts silently resurrected stale fields across concurrent store instances — the "task stuck unplanned forever" bug). - First-boot **auto-migration**: booting the PG backend over a project with a legacy `fusion.db` migrates it automatically (loud failure, SQLite kept as backup), and the dashboard shows a one-time **"your data was migrated" banner** with the backup paths and a Need-help Discord link. - `pg_dump`/`pg_restore` discovered from common install locations for embedded-mode backups. - The PG suite is part of the blocking merge gate (`test:pg-gate`). **Multi-project isolation (PR #2007, merged into this branch)** - `project_id` partition key on tasks / archived tasks / config, `taskProjectScope` threaded through every scan/claim/count, per-project config rows, layer bound to the project at startup. - Review P1 follow-up: the shared cold-storage `archive.archived_tasks` table is also partitioned and all archived-board reads/counts/searches are scoped. - Schema drift self-heal generalized to schema-qualified columns so existing databases upgrade in place. **Other changes** - Node settings sync **removed** in PG mode (409 `settings-sync-disabled-postgres`) — nodes share state by connecting to the same database; auth sync kept (per-machine file). - Perf (review findings): `listTasks` pushes column filter + ORDER BY + LIMIT/OFFSET into SQL; `getConversation` capped to the most recent 200 messages. - Fixed a false "operator action required" pause-abort log fired on every successfully auto-merged task. **Live acceptance — PASSED (2026-07-12)** A sandboxed instance (isolated HOME, embedded PG, real Opus executor) ran a task through the complete cycle: create → triage (AI spec) → execute → in-review → AI squash-merge landed on the project's `main` → done. A write+read sweep of every data surface (settings, comments, documents, attachments + artifact bridge + artifact edit, chat with real generation, goals, missions, agent mail, secrets, workflows, memory, CC analytics) was green on embedded PG. **Known remaining work** - The per-project `config` PK re-key has no upgrade path for pre-isolation embedded-PG databases (needs a real `DROP CONSTRAINT`/re-key migration; fresh databases are fine). - `pg_dump`/`pg_restore` binaries are not yet bundled in release artifacts (PATH/common-location discovery only). - The satellite-store concurrency findings listed above. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Phil Larson <hello@phillarson.xyz> Co-authored-by: fusion-merge <fusion-merge@local>
162 lines
11 KiB
TypeScript
162 lines
11 KiB
TypeScript
import { defineConfig } from "vitest/config";
|
|
import { resolve } from "node:path";
|
|
import { computeMaxWorkers } from "./src/__test-utils__/vitest-workers";
|
|
|
|
const maxWorkers = computeMaxWorkers();
|
|
|
|
const quarantinedCoreTests = [
|
|
/*
|
|
FNXC:CoreTests 2026-06-13-17:43:
|
|
The full workspace suite must not fail on suite-load-sensitive tests that pass standalone or only fail after excessive wall time. Quarantine observed core offenders after package-lane hook timeouts instead of appeasing them with wider hook timeouts.
|
|
|
|
FNXC:CoreTests 2026-06-14-02:14:
|
|
FN-6433 re-ran the core quarantine batch after FN-6430's shared fixture cleanup and rescued all five files without timeout or assertion changes. Keep this array empty unless a future quarantine is mirrored in scripts/lib/test-quarantine.json in the same commit.
|
|
|
|
FNXC:CoreTests 2026-06-15-03:13:
|
|
FN-6481 observed the disk-backed concurrent write test fail in the changed-package workspace lane with a transient SQLite BEGIN IMMEDIATE lock after the gate had already passed. Quarantine the flaky file instead of widening lock-recovery timeouts or weakening assertions.
|
|
|
|
FNXC:CoreTests 2026-06-15-07:39:
|
|
FN-6486 rescued store-concurrent-writes by making the transient lock helper release independent of event-loop timer scheduling, then removed the quarantine in lockstep with scripts/lib/test-quarantine.json. Keep this array empty unless a future observed flake is mirrored in the ledger in the same commit.
|
|
|
|
FNXC:CoreTests 2026-06-17-17:21:
|
|
FN-6596 verification observed task-list-format and test-project timing out only in the broad changed-package core lane after the merge gate had passed; both files passed immediate isolated reruns. Quarantine the suite-load flakes without widening timeouts or weakening assertions.
|
|
|
|
FNXC:CoreTests 2026-06-17-17:55:
|
|
FN-6592 rescued mission-integration by closing every reopened TaskStore handle and strengthening restart-fidelity assertions across mission hierarchy read paths. Keep the quarantine absent in both this exclude list and scripts/lib/test-quarantine.json unless a future observed flake is mirrored in both files.
|
|
|
|
FNXC:CoreTests 2026-06-17-19:03:
|
|
FN-6600 re-ran the core quarantine candidates under the broad-run worker budget and rescued the current core ledger entries without timeout, retry, assertion, or worker-budget appeasement.
|
|
Keep core quarantines mirrored here only when a loaded run still fails after shared teardown cleanup has been ruled out.
|
|
|
|
FNXC:CoreTests 2026-06-19-10:00:
|
|
FN-6705 verification observed these five files fail only in the broad changed-package core lane with hook/test timeouts, ENOTEMPTY cleanup, or a missed deferred hook after the same files passed an immediate targeted rerun. Quarantine the suite-load flakes instead of widening timeouts, adding retries, or weakening assertions.
|
|
|
|
FNXC:CoreTests 2026-06-19-10:24:
|
|
FN-6705 verification then observed settings-export time out in beforeEach only under the broad changed-package core lane while the targeted file rerun passed in 5.1s. Quarantine the suite-load hook flake instead of increasing hookTimeout.
|
|
|
|
FNXC:CoreTests 2026-06-19-14:31:
|
|
FN-6741 reloaded the six 2026-06-19 core quarantine files under the broad @fusion/core lane and rescued them in lockstep with scripts/lib/test-quarantine.json. Keep this array empty; future core suite-load flakes must prove a remaining shared worker-root/temp-redirect or fixture close-order gap before re-quarantining.
|
|
|
|
FNXC:CoreTests 2026-06-19-15:05:
|
|
Merge verification for FN-6741 observed store-concurrent-writes fail again under the broad @fusion/core lane with SQLite BEGIN IMMEDIATE lock exhaustion. Re-quarantine that single suite-load lock flake in lockstep with the ledger; keep the other rescued core files loaded.
|
|
|
|
FNXC:CoreTests 2026-06-20-05:19:
|
|
FN-6790 found no task-documents quarantine half-state on HEAD and rescued the ENOENT-rename class by quiescing deferred task-created write/hook work on TaskStore.close(). Keep task-documents loaded; do not add a ledger/config exclude unless a new loaded run fails after this lifecycle seam is ruled out.
|
|
|
|
FNXC:CoreTests 2026-06-20-09:48:
|
|
FN-6795 reloaded the remaining 2026-06-19 store-concurrent-writes quarantine under the full @fusion/core package lane and no longer reproduced SQLite BEGIN IMMEDIATE exhaustion. Rescue the file by keeping this exclude list empty in lockstep with scripts/lib/test-quarantine.json; future lock flakes need a fresh root-cause seam, not timeout/retry/worker appeasement.
|
|
|
|
FNXC:CoreTests 2026-06-25-11:15:
|
|
The SQLite-to-PostgreSQL cutover (feature quarantine-sqlite-internals-tests) quarantines the SQLite-internals test files that exercise SQLite-only behavior (PRAGMA, FTS5, VACUUM, ATTACH DATABASE, sqlite_master, node:sqlite DatabaseSync, migration sequencing) with no PostgreSQL equivalent. PgBackupManager is now the sole production backup path and the legacy SQLite BackupManager is being removed; the 'preserves branch groups' case in backup.test.ts also fails on clean baseline with a node:sqlite ERR_INVALID_ARG_TYPE binding error (TypeError: Provided value cannot be bound to SQLite parameter 1 via sqlite-adapter.ts:96). These files are mirrored in scripts/lib/test-quarantine.json and will be DELETED when the SQLite code is removed (Phase B/C of sqlite-final-removal). PG counterparts exist for backup (postgres/pg-backup.test.ts), FTS (postgres/fts-replacement.test.ts), schema (postgres/schema-applier.test.ts), central/secrets (postgres/central-archive-secrets.test.ts, postgres/secrets-roundtrip.test.ts), and mission store (postgres/satellite-mission-store.test.ts).
|
|
*/
|
|
// SQLite-internals quarantine (cutover): see scripts/lib/test-quarantine.json.
|
|
// SQLite-path failures under Node 26 node:sqlite ERR_INVALID_ARG_TYPE binding
|
|
// (quarantined on sight per AGENTS.md flaky-test rule, same cutover batch).
|
|
// Pre-existing load-sensitive PG flake (getRatings ordering under concurrent load);
|
|
// quarantined on sight per AGENTS.md so verify:workspace goes green.
|
|
/*
|
|
FNXC:CoreTests 2026-06-25-16:30:
|
|
The SQLite-to-PostgreSQL cutover (feature delete-sqlite-runtime-final, PHASE A)
|
|
quarantines the remaining non-quarantined test files that construct a SQLite-backed
|
|
store (new TaskStore(..., {inMemoryDb: true}) / new Database(...) / new AgentStore(...)
|
|
with inMemoryDb) or use the sync SQLite data path. The SQLite runtime code
|
|
(Database class, inMemoryDb option, sync prepare()/getDatabase() surface) is being
|
|
deleted in this feature. Per the AGENTS.md flaky-test deletion ratchet, these tests
|
|
are quarantined on sight (not migrated to PG) because they exercise code that will
|
|
be deleted. PG counterparts for the critical invariants exist under
|
|
src/__tests__/postgres/*.pg.test.ts. Mirrored in scripts/lib/test-quarantine.json;
|
|
will be DELETED when the SQLite code is removed.
|
|
*/
|
|
/*
|
|
FNXC:CoreTests 2026-06-25-18:00:
|
|
The SQLite-to-PostgreSQL cutover (feature delete-sqlite-runtime-final, SESSION 3 PHASE A)
|
|
quarantines the remaining 74 active test files that import store-test-helpers.ts (which
|
|
constructs TaskStore with inMemoryDb:true) or use inMemoryDb:false / new TaskStore() with
|
|
the sync SQLite data path. These tests exercise the SQLite Database class that is being
|
|
deleted in this feature. Per the AGENTS.md flaky-test deletion ratchet, they are
|
|
quarantined on sight (not migrated to PG) because they test code we are about to delete.
|
|
PG counterparts for critical invariants exist under src/__tests__/postgres/*.pg.test.ts.
|
|
Mirrored in scripts/lib/test-quarantine.json; will be DELETED when the SQLite code is removed.
|
|
*/
|
|
/*
|
|
FNXC:SqliteFinalRemoval 2026-06-26-10:15:
|
|
The SQLite Database/CentralDatabase/ArchiveDatabase class bodies were deleted
|
|
(VAL-REMOVAL-005, feature physical-delete-db-class-final). These test files
|
|
exercise the legacy sync SQLite data path — they construct Database/
|
|
CentralDatabase/CentralCore(in non-backend mode)/TaskStore(sync path) directly
|
|
and call init()/prepare()/transaction() which now throw because the SQLite
|
|
runtime is removed. They are quarantined on sight per the AGENTS.md flaky-test
|
|
deletion ratchet (not migrated to PG) because they test code that has been
|
|
deleted. PG counterparts for the critical invariants exist under
|
|
src/__tests__/postgres/*.pg.test.ts (central-core-backend, secrets-roundtrip,
|
|
satellite stores, etc). Mirrored in scripts/lib/test-quarantine.json; these
|
|
files will be DELETED on the 14-day ratchet (2026-07-10) unless rescued.
|
|
*/
|
|
"src/__tests__/central-core.test.ts",
|
|
"src/__tests__/central-claim-mutex.test.ts",
|
|
"src/__tests__/central-integration.test.ts",
|
|
"src/__tests__/central-core-docker-node.test.ts",
|
|
"src/__tests__/central-core-ensure-project.test.ts",
|
|
"src/__tests__/central-project-node-mappings.test.ts",
|
|
"src/__tests__/commit-association-diff-backfill.real-git.test.ts",
|
|
"src/__tests__/docker-node-config.test.ts",
|
|
"src/__tests__/first-run.test.ts",
|
|
"src/__tests__/migration-orchestrator.test.ts",
|
|
"src/__tests__/migration.test.ts",
|
|
"src/__tests__/mission-factory-parity.integration.test.ts",
|
|
"src/__tests__/mission-integration.test.ts",
|
|
"src/__tests__/multi-node-dashboard.test.ts",
|
|
"src/__tests__/project-isolation-transition.test.ts",
|
|
"src/__tests__/secrets-store.test.ts",
|
|
"src/__tests__/secrets-sync-passphrase.test.ts",
|
|
"src/__tests__/settings-parity.test.ts",
|
|
"src/__tests__/store-activity.test.ts",
|
|
"src/__tests__/store-handoff-to-review.test.ts",
|
|
"src/__tests__/store-plugin-store-close.test.ts",
|
|
"src/__tests__/store-secrets-store-global-dir.test.ts",
|
|
"src/__tests__/store-settings-sync-passphrase-probe.test.ts",
|
|
"src/__tests__/todo-store.test.ts",
|
|
];
|
|
|
|
export default defineConfig({
|
|
resolve: {
|
|
alias: {
|
|
"@fusion/core": resolve(__dirname, "./src/index.ts"),
|
|
"@fusion/test-utils": resolve(__dirname, "./src/__test-utils__/workspace.ts"),
|
|
"@fusion/plugin-sdk": resolve(__dirname, "../plugin-sdk/src/index.ts"),
|
|
},
|
|
},
|
|
test: {
|
|
include: ["src/**/*.test.ts"],
|
|
exclude: quarantinedCoreTests,
|
|
setupFiles: [
|
|
"./src/__test-utils__/vitest-setup.ts",
|
|
],
|
|
globalSetup: ["./src/__test-utils__/vitest-teardown.ts"],
|
|
// Must stay "forks". Two thread-unsafe patterns block migration to "threads":
|
|
//
|
|
// 1. vitest-setup.ts:123 — `process.chdir(workerTempDir)` is gated by
|
|
// `isMainThread`, which is `false` in worker_threads, so each thread
|
|
// worker never gets its isolated cwd. Tests that rely on cwd being a
|
|
// disposable temp dir would silently operate in the repo root.
|
|
//
|
|
// 2. Some suites rely on fork-level process/env isolation for setup side effects,
|
|
// and cannot safely share mutable process state under worker_threads.
|
|
pool: "forks",
|
|
maxWorkers,
|
|
minWorkers: 1,
|
|
fileParallelism: true,
|
|
// Core runs a large SQLite-heavy suite while other workspace packages test concurrently.
|
|
// Use a slightly higher timeout to reduce nondeterministic slow-machine flakes.
|
|
testTimeout: 15_000,
|
|
hookTimeout: 15_000,
|
|
coverage: {
|
|
enabled: false,
|
|
reporter: ["text", "html", "json"],
|
|
reportsDirectory: "./coverage",
|
|
include: ["src/**/*.ts"],
|
|
exclude: ["**/*.test.ts", "**/*.d.ts", "dist/**"],
|
|
},
|
|
},
|
|
});
|