- Config.MCPTokensPurge + scheduleEntry branch
- app.go constructs runner with mcpTokensPurgeAdapter
- Registered as 'mcp_tokens_purge' in RunnerFns map
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Periodic delete of mcp_tokens where (expired OR revoked) before retention
- 24h interval default, 7d retention default
- Mirrors acp_events_purge pattern: idempotent, error-tolerant
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sqlc reads all migrations into every package's schema, so the
addition of acp_* tables and workspaces.active_main_session_id
in migration 0006 propagates type definitions and SELECT
column lists across all sub-packages. No code logic changes.
- workspace.ResetStuckSyncStatuses now returns affected IDs so app.New can record one workspace.sync_aborted_on_restart audit per reset row
- worktree_prune audit metadata gains workspace_id and path alongside existing branch
- updated fakeRepo + integration test for new ResetStuckSyncStatuses signature
- add TestWorktreePrune_AuditMetadataContainsWorkspaceIDAndPath
Deferred audit retrofits from Plan #5 self-review:
- WebhookNotifier now records a job.enqueue audit row after each
successful repo.Enqueue (best-effort: failures are warn-logged, not
propagated). Added optional audit.Recorder + *slog.Logger params to
NewWebhookNotifier.
- WorktreePrune.executionPhase now records a worktree.pruned audit row
after each successful FinishPruneSuccess. Added optional audit.Recorder
param to NewWorktreePrune.
- app.go wires the existing auditRec into both constructors.
- integration_test.go: drop the _ = auditRec suppression and pass
auditRec into the webhook notifier so the closed-loop test exercises
the audit emit path.
Cross-cutting review polish:
- worker.go: id/type → job_id/job_type; one stray attempts → attempt for
consistency with the other 4 sites in the same file.
- runners/workspace_fetch.go: ws_id → workspace_id (matches the dispatched
notify.Message metadata key).
- runners/worktree_prune.go: id → worktree_id (same reason).
- runners/worktree_prune_test.go: add TestWorktreePrune_NoRowsIsNoOp for
symmetry with the no-op tests in the other 4 runner test files.
- migrations/0005_jobs.down.sql: comment that DROP TABLE jobs cascades to
drop the three idx_jobs_* indexes automatically.
Module.Stop used time.After which leaks the timer if the done channel
wins first; switch to time.NewTimer + defer Stop() to align with the
codebase convention.
scheduleEntry silently returned {0, false} for unknown runner names —
typos in production wiring were invisible. Return (entry, known) and
log Warn at NewModule registration time so misconfiguration surfaces.
Previously, write-back errors from Complete/DeadLetter/FailWithRetry
were silently dropped via underscore assignment. A transient DB
failure here would leave a job stuck (still 'running' with active
lease) until the reaper resets it, with zero observability into why.
Log each write-back error at Error level so operators can correlate
stuck jobs with DB symptoms. Code quality review of T8.
q792602257