[senamakel]

Paused at the user's request — draft, do not merge

Implementation stopped at the current committed checkpoint. The user asked to stop, commit/publish existing work and pause. Final validation was canceled intentionally; no canceled run is counted as passing. Normal Git push hooks remain enabled. A successful push is not evidence that the repository's separately required explicit project-hook validation completed.

Summary

Reject malformed legacy retry budgets and single-flight values before migrating cron policies. Document-store decoding now checks u32 bounds and requires a real boolean; SQLite validates legacy storage types and values before its transactional update/drop.

Validation

Actual unfixed owner tests produced three runtime failures: document retries, document single-flight and SQLite budget coercion. This established RED, not a compiler-only failure. The subsequent focused GREEN candidate45571 was canceled143 while queued at the user's request, before running. Formatting/source review passed; final owner tests and full gates have not passed.

Remaining work before ready

Run the strict-malformed regression GREEN and full owner gates. Deterministically prove/fix document policy CAS migration and nontransactional refusal; extend SQLite malformed-type and separately located legacy-policy fixtures. This narrow commit does not claim complete scheduler host migration or concurrency safety. External prepared tests are preserved as unapplied artifacts and are not shipped as implemented tests.

Commit

84381aa. Preserve the preceding granular RED fixture commitc39737d.

Related

Prerequisite for OpenHuman #7397; no claim to close that host issue.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T07:07:06.860107Z	84381aa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

⏳ Reviewing 2cc31cbc9125 now. The last completed report, when available, remains below until this pass finishes.

Previous completed report

Tiny Sweeper review

Reviewed head: 84381aaa52f5be55ce0925df182670dcea01d5e1

Findings

No active actionable findings.

Advisory notes

• medium: Rewrite the paused-draft description to describe the change ((pull request description))
  Problem: The title and summary describe the code (rejecting malformed legacy policies before migration), and the diff does exactly that. But the body is not a description of this change: it
  Suggested fix:

  ## Summary
  
  Reject malformed legacy retry budgets and single-flight values before migrating cron policies.
  
  - Document store (`crates/tinyflows-drivers/src/schedule/policy.rs`): a legacy `retries` that is present but not a `u64` in `u32` range, or a missing/non-boolean `single_flight`, now makes migration fail closed instead of silently clamping/defaulting. Missing or null `retries` still means no retry budget.
  - SQLite (`crates/tinyflows-sqlite/src/schedule/schema.rs`): before the transactional UPDATE/DROP of `cron_job_policies`, the migration checks every row's `retries` (NULL or integer in `0..=u32::MAX`) and `single_flight` (integer `0`/`1`). Any malformed row aborts with the policy table left untouched, so the value stays available for repair. The old `MIN/MAX` clamping is removed since out-of-range values are now rejected rather than coerced.
  
  ## Tests
  
  - `crates/tinyflows-drivers/src/schedule/mod_tests.rs`: malformed legacy retries (`"2"`, `-1`, `u32::MAX + 1`) and malformed/missing `single_flight` make `get_job` error while leaving both the seeded job and the invalid policy document unchanged.
  - `crates/tinyflows-sqlite/src/schedule/policy_tests.rs`: out-of-range `retries` (`-1`, `u32::MAX + 1`) make `get_job` error, with both `cron_job_policies` and the seeded `cron_jobs` row unchanged.
  
  ## Not covered
  
  Document policy CAS migration against a concurrent writer and SQLite malformed-type fixtures are not addressed here.
  
  ## Related
  
  Prerequisite for OpenHuman #7397.
  

Verdict: Ready for maintainer review · Priority: medium
Coverage: Reviewed 4 of 4 files.

Diagnostics and supporting details

Full summary

Pull request purpose (title): Reject malformed legacy scheduler policies before migration. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	2	Noted findings	1
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Document-store decoding of legacy cron policies now returns an error rather than silently defaulting or clamping when `retries` is non-numeric or out of u32 range, and requires a real boolean for `single_flight`. On the SQLite side, the policy migration query validates legacy column types and value ranges inside its transaction and bails before any update or drop if any row is malformed, removing the prior MIN/MAX clamping. New tests on both sides assert refusal plus preservation of the seeded job and the invalid policy row.

Features

• Modified — Fail-closed decoding of legacy document-store cron policies: A malformed legacy policy now causes `get_job` to error instead of being coerced (previously retries out of range were clamped to u32::MAX and a missing/non-boolean single_flight defaulted to false), so scheduling is blocked until the policy is repaired and the invalid policy is preserved. (crates/tinyflows-drivers/src/schedule/policy.rs impl CronDocuments {)
• Modified — Fail-closed SQLite legacy policy migration: Before updating `cron_jobs` and dropping `cron_job_policies`, the transaction checks for non-integer retries, negative or >4294967295 retries, and single_flight values outside 0/1; if any row is malformed it bails with the policy table unchanged, and the clamping expression is replaced by a direct copy. (crates/tinyflows-sqlite/src/schedule/schema.rs fn migrate_policies(conn: &Connection) -> Result<()> {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Note it reports the code index is behind the PR head, so retrieved context may be stale.
• Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `846f198fd6ef`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane answered with 0 findings; no security concern raised by the fail-closed validation change.
• Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `846f198fd6ef`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane confirmed the fail-closed behavior is covered on both sides, with assertions that job and policy rows are preserved on refusal. It noted one remaining gap: the `malformed` guard is a single boolean over the whole table, so one bad row makes every connection fail, and the non-integer storage-class and single_flight non-0/1 branches are not pinned by tests.
• Lane summary: The fail-closed change is covered on both sides: the drivers test exercises the malformed retries and single_flight paths through `get_job` and asserts the job and policy rows are preserved, and the sqlite test asserts rejection plus preservation of the legacy table and seeded job. One gap remains: the new `malformed` guard in `migrate_policies` is a single boolean over the whole table, so one bad row makes every connection fail, but no test pins the non-integer storage class (`typeof(retries) != 'integer'`) that the sqlite test's `INTEGER` columns cannot produce, nor the `single_flight` non-0/1 branch. _The code index is behind this pull request (indexed at `846f198fd6ef`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane answered with no sensitive content found in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `846f198fd6ef`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane found the code and new tests sound, with the sole issue being the description, which is written as a paused draft about its own validation/process state rather than describing what the diff does. No findings were recorded in the lane's findings list.
• Lane summary: The change makes legacy cron-policy migration fail closed: document-store decoding now rejects non-numeric/out-of-range retries and non-boolean single_flight, and the SQLite migration validates legacy column types and values inside its transaction before updating or dropping the table. The code and new tests look sound; the one issue is the description, which is written as a paused draft about its own validation process rather than describing what the diff does. _The code index is behind this pull request (indexed at `846f198fd6ef`), so retrieved context may be out of date._

Evidence and run details

• Models: deepseek-v4.1-flash, ladder/vectors-oai3
• Spend: $0.000731
• Tokens: 514248 input · 9845 output · 126976 cached · 270 embedding
• Updated: 2026-10-24T07:00:37Z

Head	State	Pass summary
84381aaa52f5	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-24T07:00:37Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0007