fix(db): restore prod-applied orphan migrations into repo history

[riderx]

Summary (AI generated)

• Restored five production-applied migrations that existed only in remote schema_migrations (never committed under those version IDs):
  • 20260725111831_fix_reclaim_no_timeout_max_work
  • 20260725111921_fix_reclaim_encrypt_trigger_guc
  • 20260725111931_fix_reclaim_cron_catch_canceled
  • 20260725162854_skip_audit_dual_storage_manifest_count
  • 20260725182614_slim_audit_logs_skip_bookkeeping
• SQL was dumped from prod supabase_migrations.schema_migrations.statements (exact applied content).
• Renamed never-pushed 20260725163259_slim_audit_logs_skip_bookkeeping → 20260725190000_slim_audit_logs_keep_native_packages_auditable so fresh db reset applies the native_packages audit fix after prod's 82614 slim migration.

Motivation (AI generated)

supabase db push failed because remote history had version IDs missing from git. Marking them reverted would have been wrong: the SQL is already live. Restoring the files keeps history honest and unblocks deploy of pending local migrations.

Business Impact (AI generated)

Unblocks production DB deploys without rewriting applied reclaim/audit fixes. Pending local migrations (billing period stats cron, weekly stats window, app create storage RLS, native_packages audit fix) can be pushed after merge.

Test Plan (AI generated)

• supabase migration list shows the five restored versions present on both local and remote
• After merge: run bunx supabase db push (applies local-only pending migrations; does not re-run the five restored ones)
• If a local DB already recorded 20260725163259, repair that version (bunx supabase migration repair --status reverted 20260725163259) then reset/push as needed
• Confirm prod audit_log_trigger still keeps native_packages changes auditable after the pending 190000 migration applies

Generated with AI

Made with Cursor

Summary by CodeRabbit

• Reliability

  • Improved background queue cleanup with explicit runtime limits and safer batch processing.
  • Scheduled tasks now handle cancellations more gracefully and prevent overlapping runs.

• Security

  • Strengthened encrypted bundle enforcement, including required encryption-key validation.

• Audit Logs

  • Reduced noise from routine bookkeeping updates.
  • Preserved meaningful application-version changes while limiting oversized audit records.

• Maintenance

  • Improved migration validation for approved production-history restores.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 99415d44-96ea-4f89-8411-7f100a79943a

📥 Commits

Reviewing files that changed from the base of the PR and between 70d328a and 35b59d7.

📒 Files selected for processing (8)

• scripts/check-supabase-migration-order.sh
• scripts/supabase-worktree.ts
• supabase/migrations/20260725111831_fix_reclaim_no_timeout_max_work.sql
• supabase/migrations/20260725111921_fix_reclaim_encrypt_trigger_guc.sql
• supabase/migrations/20260725111931_fix_reclaim_cron_catch_canceled.sql
• supabase/migrations/20260725162854_skip_audit_dual_storage_manifest_count.sql
• supabase/migrations/20260725182614_slim_audit_logs_skip_bookkeeping.sql
• supabase/migrations/20260725190000_slim_audit_logs_keep_native_packages_auditable.sql

---

📝 Walkthrough

Walkthrough

The pull request updates Supabase migration and lint safeguards, replaces reclaim cleanup and cron execution logic, refines encrypted bundle validation, and evolves audit-trigger filtering, actor attribution, and payload storage.

Changes

Supabase runtime and migration safeguards

Layer / File(s)	Summary
Migration and lint safeguards scripts/check-supabase-migration-order.sh, scripts/supabase-worktree.ts	Migration timestamp regressions can be allowed for hash-matched production restores, and db lint --fail-on warning is rewritten to fail on errors.
Timeout-safe reclaim cleanup supabase/migrations/20260725111831_fix_reclaim_no_timeout_max_work.sql	cleanup_queue_messages now uses bounded batches and an explicit runtime budget, disables statement timeouts, removes competing overloads, and restricts privileges.
Encrypted bundle update validation supabase/migrations/20260725111921_fix_reclaim_encrypt_trigger_guc.sql	Bundle updates receive manifest and ready-state checks, organization encryption enforcement, and required-key validation.
Cancellable cron task orchestration supabase/migrations/20260725111931_fix_reclaim_cron_catch_canceled.sql	process_all_cron_tasks schedules and dispatches enabled tasks under an advisory lock, handles cancellations, and updates selected task metadata.
Audit event filtering and payload shaping supabase/migrations/20260725162854_skip_audit_dual_storage_manifest_count.sql	Audit logging identifies actors, computes changed fields, skips selected bookkeeping updates, maps records to organizations, and sanitizes app-version payloads.
Bookkeeping audit suppression supabase/migrations/20260725182614_slim_audit_logs_skip_bookkeeping.sql	Audit trigger behavior is refined for API-key actors, app-version bookkeeping changes, statistics updates, and large JSON fields.
Native package audit retention supabase/migrations/20260725190000_slim_audit_logs_keep_native_packages_auditable.sql	Audit skip rules and actor validation are updated while large manifest and native package fields are excluded from stored app-version payloads.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Cron as process_all_cron_tasks
  participant Tasks as cron_tasks
  participant Queue as pgmq
  participant FunctionQueue as process_function_queue
  Cron->>Tasks: Read enabled scheduled tasks
  Cron->>Queue: Dispatch queue tasks
  Cron->>FunctionQueue: Process function queues
  Cron->>Cron: Release advisory lock

Loading

Possibly related PRs

• Cap-go/capgo.app#2688: Updates the same migration blob-hash allowlist area.
• Cap-go/capgo.app#2721: Evolves the same reclaim cleanup, encryption trigger, audit trigger, and cron task logic.
• Cap-go/capgo.app#2760: Directly overlaps with audit-log filtering and app-version payload slimming.

Suggested labels: codex

Suggested reviewers: dalanir, wcaleniewolny

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing fix/restore-prod-orphan-migrations (35b59d7) with main (70d328a)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e7cddc0e-1281-4f79-9308-b247caae6e86)

[cursor]

Risk: high. Cursor Bugbot did not complete (usage limit reached), so automated review is unavailable. This restores prod-applied DB migrations and needs human verification; reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Risk: high. Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is unavailable. Restoring production-applied database migrations exceeds the low-risk approval threshold; human review is required and I did not approve.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}