Files
multica/server/migrations/332_issue_status.up.sql
446080bd57 MUL-6243 feat(issue-status): per-workspace custom issue statuses over 7 canonical categories (#7065)
* feat(issue-status): per-workspace custom issue statuses over 7 canonical categories (MUL-6243)

Co-authored-by: multica-agent <[email protected]>

* fix(issue-status): address review — normalize all status consumers, close archive race, gate rollout, split PK index

Review round 1 (MUL-6243 / PR #7065):

1. Behavior normalization was incomplete. Adds issue_effective_status() as a
   SQL mirror of issuestatus.Effective so the six SQL consumers the Go resolver
   cannot reach (duplicate guard, open-issue list, sub-issue progress, project
   stats, completed-inbox archive, open_only) resolve categories too. Wires the
   resolver into the task-failure sweeper and the stage-barrier helpers.

2. Archive TOCTOU. Archive now runs its in-use census and the archive itself in
   one transaction under an exclusive catalog lock; writes that target a custom
   status take the shared side. Built-in writes stay lock-free — a built-in can
   never be archived.

3. Rollout safety. Creating a custom status is gated behind the default-off
   CustomIssueStatuses flag, so a value old pods cannot interpret cannot exist
   until the fleet is updated. Readers ship ungated and are safe.

4. Primary key index. Follows the repo convention (327-329): table without a
   PK, unique index built CONCURRENTLY in its own migration, attached via
   PRIMARY KEY USING INDEX, and registered for invalid-index cleanup.

5. Status normalization vs stored value. Write paths now persist the canonical
   key from Resolve, so 'HUMAN_REVIEW' no longer validates and then fails the
   column format constraint as a 500.

Also fixes the two CLI tests failing in CI: they asserted the pre-MUL-6243
contract that an unknown-but-well-formed status is rejected locally.

Co-authored-by: multica-agent <[email protected]>

* fix(issue-status): close the archive race in both orderings; resolve categories in batch barrier and CLI progress

Review round 2 (MUL-6243 / PR #7065):

1. The archive race was only half closed. Handlers resolved the status BEFORE
   opening a transaction, so an archive could commit in that window and the
   write would still land on an archived key. assertIssueStatusStillActive now
   takes the shared catalog lock and RE-RESOLVES inside the caller's
   transaction, which is what actually makes the status provably active at
   write time. Applied to create, update, batch, and both description-merge
   branches, which previously bypassed the guard entirely. A losing writer gets
   409 rather than a silent partial update.

2. The batch stage-barrier prefilter still compared literals, so a batch that
   moved the last child onto a custom done status left childDoneCompleted empty
   and skipped the parent notification. It now resolves categories first.

3. multica issue children --output json counted only literal done/cancelled.
   ListChildIssues now emits status_category and the CLI reads it, falling back
   to status for older backends.

TestArchiveCommitsInsideTheWriteRaceWindow interleaves the two operations so the
writer validates against an active status and the archive commits before the
write. Verified it fails without the re-resolve (issue stranded on the archived
status) and passes with it.

Co-authored-by: multica-agent <[email protected]>

* refactor(issue-status): address review nits — honest race-test naming, one catalog read per list

Review round 3 nits (MUL-6243 / PR #7065):

1. TestArchiveRaceBothOrderings claimed more than it proved. Its 'archive wins'
   cases archived first and only then sent the request, which the pre-flight
   check alone rejects. Split into TestWritesRejectAnArchivedStatus (the
   sequential case, named for what it is) and TestArchiveRefusesAfterACommitted
   Write, and extended TestArchiveCommitsInsideTheWriteRaceWindow — the only
   test that truly interleaves archive between pre-flight and write — from
   create alone to all five write endpoints. Re-verified by deleting the
   in-transaction re-resolve: 4 of 5 fail with issues stranded on the archived
   status (create is guarded in the service layer and checked separately).

2. ListChildIssues / ListChildrenByParents issued one category lookup per
   custom-status child. issuestatus.Resolver now amortizes that to a single
   catalog read per request, lazily on the first custom key, so built-in
   statuses still cost zero queries however long the list is.

Co-authored-by: multica-agent <[email protected]>

---------

Co-authored-by: Bohan-J <[email protected]>
Co-authored-by: multica-agent <[email protected]>
2026-08-17 18:32:02 +08:00

63 lines
3.1 KiB
SQL

-- Custom Issue Status catalog (MUL-6243).
--
-- MODEL: the 7 categories map ONE-TO-ONE onto the 7 built-in statuses, and a
-- category's value IS its canonical status key. A custom status names a
-- category and inherits that canonical's platform behavior wholesale, so there
-- is no second "behaves_as" concept and no way to build a status that inherits
-- only half of a behavior.
--
-- `issue.status` stays the authoritative TEXT column and keeps holding a key
-- from this catalog, so no status_id, no backfill, and no double-write: every
-- existing `WHERE status = 'todo'` and `issue.Status == "backlog"` keeps
-- working verbatim because the 7 built-in keys never change.
--
-- No foreign keys (workspace_id is an application-layer relation, per the
-- project's database rules); cleanup is handled by the application.
--
-- id is NOT declared inline as PRIMARY KEY: the repo convention (see migrations
-- 327-329) is to build the table without a primary key, create the backing
-- unique index CONCURRENTLY in its own single-statement migration (333), then
-- attach it with PRIMARY KEY USING INDEX (334). An inline PRIMARY KEY would
-- build its index non-concurrently, which the project's migration rules forbid
-- even on a new table.
CREATE TABLE issue_status (
id UUID NOT NULL DEFAULT gen_random_uuid(),
workspace_id UUID NOT NULL,
-- Stable machine handle. Immutable after create: it is what `issue.status`
-- stores, what the CLI accepts, and what agent instructions reference.
key TEXT NOT NULL CHECK (key ~ '^[a-z0-9][a-z0-9_]{0,31}$'),
-- Human-facing label. Editable for custom statuses; locked for built-ins.
name TEXT NOT NULL CHECK (char_length(name) BETWEEN 1 AND 64),
description TEXT NOT NULL DEFAULT '' CHECK (char_length(description) <= 256),
-- Behavior equivalence class. Immutable after create — changing it would
-- silently rewrite the machine semantics of every issue already sitting on
-- this status, with no audit trail.
category TEXT NOT NULL CHECK (
category IN ('backlog', 'todo', 'in_progress', 'in_review', 'done', 'blocked', 'cancelled')
),
-- "#rrggbb". Built-in rows carry the seeded palette for API consumers, but
-- clients that already know a built-in key keep rendering it from their own
-- config, so the default experience stays pixel-identical.
color TEXT NOT NULL CHECK (color ~ '^#[0-9a-f]{6}$'),
is_system BOOLEAN NOT NULL DEFAULT FALSE,
position DOUBLE PRECISION NOT NULL DEFAULT 0,
archived_at TIMESTAMPTZ,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-- A built-in row IS its category's canonical, so its key must equal its
-- category. This is what makes Effective() an identity function on built-in
-- keys, which is in turn what keeps every existing status check correct.
CONSTRAINT issue_status_system_is_canonical
CHECK (NOT is_system OR key = category),
-- Archiving a built-in would delete its category's behavior definition.
CONSTRAINT issue_status_system_not_archivable
CHECK (NOT is_system OR archived_at IS NULL)
);