Fresh boot creates the DB at the latest schema version (0000_bootstrap,0001_init) and a second boot is a no-op; a broken migration rolls back, leaves the previous version and schema intact, and fails boot (internal/store migrate tests).
Generated sqlc code is checked in and CI fails on drift: .gitea/workflows/ci.yml runs make sqlc-check (pinned sqlc v1.31.1) after make test; push run 6036 and pull_request run 6037 on the final task head both succeeded.
Repository tests cover insert/read/update and constraint violations for the core tables (internal/store/schema_test.go, internal/db/db_test.go).
Integration suite at the feature head: make test and make build both exit 0; gofmt -l . empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok.
Approved dependencies only: modernc.org/sqlite, github.com/oklog/ulid/v2; sqlc is a dev tool (not in go.mod require).
This PR merges the feature branch into dev (merge commit, matching Feature 01).
Feature 02 (SQLite Data Layer and Schema) — all 4 tasks verified in the feature branch.
WHAT: SQLite database in /data with the full v1 schema, an embedded migration runner and sqlc-generated typed queries (CTXD CONTEXT.MD, D-003).
Tasks:
- Task 1 (aa75e790): SQLite connection + embedded migration runner — PR #10.
- Task 2 (120dd5b6): Store helpers: transactions, ULIDs, time conventions — PR #11.
- Task 3 (473f65aa): Initial v1 schema migration (25 tables) — PR #12.
- Task 4 (c4c8a839): sqlc configuration and core queries — PR #13.
Feature done-condition evidence:
- Fresh boot creates the DB at the latest schema version (0000_bootstrap,0001_init) and a second boot is a no-op; a broken migration rolls back, leaves the previous version and schema intact, and fails boot (internal/store migrate tests).
- Generated sqlc code is checked in and CI fails on drift: .gitea/workflows/ci.yml runs make sqlc-check (pinned sqlc v1.31.1) after make test; push run 6036 and pull_request run 6037 on the final task head both succeeded.
- Repository tests cover insert/read/update and constraint violations for the core tables (internal/store/schema_test.go, internal/db/db_test.go).
- Integration suite at the feature head: make test and make build both exit 0; gofmt -l . empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok.
- Approved dependencies only: modernc.org/sqlite, github.com/oklog/ulid/v2; sqlc is a dev tool (not in go.mod require).
This PR merges the feature branch into dev (merge commit, matching Feature 01).
{"verdict":"CHANGES_REQUIRED","reviewed_sha":"17a69f4de77e3d89c92e310cd8db53116aec3292","summary":"The migration, schema constraint, transaction, and generated-query tests pass, as do gofmt, go vet, and go test -race -count=1 ./.... The feature does not yet meet the stated repository coverage condition. A separate CGO_ENABLED=0 test attempt was blocked when the read-only sandbox refused to create a Go work directory; sqlc was unavailable locally.","findings":[{"id":"F1","severity":"medium","location":"internal/db/querier.go; internal/db/db_test.go; internal/store/schema_test.go","failure_case":"Insert/read/update behavior for core planning, suggestion, and shopping tables is unverified, so the named repository-test done-condition is unmet.","evidence":"The generated Querier has no methods for week_plans, plan_days, suggestions, shopping_lists, shopping_groups, or shopping_items. Their schema tests seed rows and check constraints, but do not read or update those rows.","suggested_correction":"Add sqlc queries and repository tests that insert, read, and update these core tables, alongside their constraint tests."},{"id":"F2","severity":"medium","location":"internal/store/migrate_test.go:84; cmd/server/main_test.go","failure_case":"The required second-boot no-op and failed-migration boot refusal are not tested through a restart.","evidence":"TestMigrateSecondRunIsNoOp calls Migrate twice on the same open Store. The server tests cover logging only; none reopen a persisted database or verify that a migration failure prevents the listener from starting.","suggested_correction":"Add boot-path tests that close and reopen the same data directory, compare migration records, and verify startup stops on migration failure."},{"id":"F3","severity":"medium","location":"migrations/0001_init.sql:131; internal/db/dinners.sql.go:66; internal/db/models.go:269","failure_case":"Invalid timestamp and local-date strings can be stored despite the UTC RFC 3339 and YYYY-MM-DD guardrails.","evidence":"The schema uses unconstrained TEXT columns for these values, and generated query parameters use string. The validated Timestamp and LocalDate helpers are not used by the generated queries.","suggested_correction":"Enforce the storage formats at the database boundary and test rejection of malformed timestamps and dates."},{"id":"F4","severity":"medium","location":"migrations/0001_init.sql:280; migrations/0001_init.sql:329","failure_case":"The schema provides plaintext columns for secret material despite the *_ct ciphertext guardrail.","evidence":"push_subscriptions.auth holds the Web Push authentication secret and sessions.csrf_token holds a CSRF secret; both are declared as TEXT without a *_ct name.","suggested_correction":"Store secret values in appropriately named ciphertext columns and update the corresponding model and tests."}]}
Posted unaltered by review_agent. This is transport, not a second review.
## Independent review — Codex `gpt-6-sol`, reasoning high
Verdict: **CHANGES_REQUIRED**
Reviewed SHA: `17a69f4de77e3d89c92e310cd8db53116aec3292`
```json
{
"verdict": "CHANGES_REQUIRED",
"reviewed_sha": "17a69f4de77e3d89c92e310cd8db53116aec3292",
"summary": "The migration, schema constraint, transaction, and generated-query tests pass, as do gofmt, go vet, and go test -race -count=1 ./.... The feature does not yet meet the stated repository coverage condition. A separate CGO_ENABLED=0 test attempt was blocked when the read-only sandbox refused to create a Go work directory; sqlc was unavailable locally.",
"findings": [
{
"id": "F1",
"severity": "medium",
"location": "internal/db/querier.go; internal/db/db_test.go; internal/store/schema_test.go",
"failure_case": "Insert/read/update behavior for core planning, suggestion, and shopping tables is unverified, so the named repository-test done-condition is unmet.",
"evidence": "The generated Querier has no methods for week_plans, plan_days, suggestions, shopping_lists, shopping_groups, or shopping_items. Their schema tests seed rows and check constraints, but do not read or update those rows.",
"suggested_correction": "Add sqlc queries and repository tests that insert, read, and update these core tables, alongside their constraint tests."
},
{
"id": "F2",
"severity": "medium",
"location": "internal/store/migrate_test.go:84; cmd/server/main_test.go",
"failure_case": "The required second-boot no-op and failed-migration boot refusal are not tested through a restart.",
"evidence": "TestMigrateSecondRunIsNoOp calls Migrate twice on the same open Store. The server tests cover logging only; none reopen a persisted database or verify that a migration failure prevents the listener from starting.",
"suggested_correction": "Add boot-path tests that close and reopen the same data directory, compare migration records, and verify startup stops on migration failure."
},
{
"id": "F3",
"severity": "medium",
"location": "migrations/0001_init.sql:131; internal/db/dinners.sql.go:66; internal/db/models.go:269",
"failure_case": "Invalid timestamp and local-date strings can be stored despite the UTC RFC 3339 and YYYY-MM-DD guardrails.",
"evidence": "The schema uses unconstrained TEXT columns for these values, and generated query parameters use string. The validated Timestamp and LocalDate helpers are not used by the generated queries.",
"suggested_correction": "Enforce the storage formats at the database boundary and test rejection of malformed timestamps and dates."
},
{
"id": "F4",
"severity": "medium",
"location": "migrations/0001_init.sql:280; migrations/0001_init.sql:329",
"failure_case": "The schema provides plaintext columns for secret material despite the *_ct ciphertext guardrail.",
"evidence": "push_subscriptions.auth holds the Web Push authentication secret and sessions.csrf_token holds a CSRF secret; both are declared as TEXT without a *_ct name.",
"suggested_correction": "Store secret values in appropriately named ciphertext columns and update the corresponding model and tests."
}
]
}
```
---
Posted unaltered by `review_agent`. This is transport, not a second review.
{"verdict":"APPROVED","reviewed_sha":"c1a868c48be0d0b4fcbd230dca33ce1245d271c3","summary":"The feature’s named boot, migration, repository, and constraint cases have visible tests. gofmt, go vet, and go test -race -count=1 ./... passed. The CGO-disabled build could not run because the read-only sandbox blocked Go from creating a work directory. No blocking defect found.","findings":[{"id":"F1","severity":"low","location":"Makefile:87","failure_case":"The sqlc drift check can pass if git status fails and produces no stdout.","evidence":"The recipe checks only whether captured stdout is nonempty. Reproducing that shell pattern with a failing git status command returned exit code 0.","suggested_correction":"Check the exit status of git status separately and fail the target when it errors."}]}
Posted unaltered by review_agent. This is transport, not a second review.
## Independent review — Codex `gpt-6-sol`, reasoning high
Verdict: **APPROVED**
Reviewed SHA: `c1a868c48be0d0b4fcbd230dca33ce1245d271c3`
```json
{
"verdict": "APPROVED",
"reviewed_sha": "c1a868c48be0d0b4fcbd230dca33ce1245d271c3",
"summary": "The feature’s named boot, migration, repository, and constraint cases have visible tests. gofmt, go vet, and go test -race -count=1 ./... passed. The CGO-disabled build could not run because the read-only sandbox blocked Go from creating a work directory. No blocking defect found.",
"findings": [
{
"id": "F1",
"severity": "low",
"location": "Makefile:87",
"failure_case": "The sqlc drift check can pass if git status fails and produces no stdout.",
"evidence": "The recipe checks only whether captured stdout is nonempty. Reproducing that shell pattern with a failing git status command returned exit code 0.",
"suggested_correction": "Check the exit status of git status separately and fail the target when it errors."
}
]
}
```
---
Posted unaltered by `review_agent`. This is transport, not a second review.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Feature 02 (SQLite Data Layer and Schema) — all 4 tasks verified in the feature branch.
WHAT: SQLite database in /data with the full v1 schema, an embedded migration runner and sqlc-generated typed queries (CTXD CONTEXT.MD, D-003).
Tasks:
Feature done-condition evidence:
This PR merges the feature branch into dev (merge commit, matching Feature 01).
Independent review — Codex
gpt-6-sol, reasoning highVerdict: CHANGES_REQUIRED
Reviewed SHA:
17a69f4de77e3d89c92e310cd8db53116aec3292Posted unaltered by
review_agent. This is transport, not a second review.Independent review — Codex
gpt-6-sol, reasoning highVerdict: APPROVED
Reviewed SHA:
c1a868c48be0d0b4fcbd230dca33ce1245d271c3Posted unaltered by
review_agent. This is transport, not a second review.