Implement durable agent runtime foundations

[Dastari]

What changed

This draft builds a project-agnostic, ORM-owned durable agent runtime for graphql-orm applications:

• owner-isolated sessions, messages, attachments, inboxes, subscriptions, protected content, fenced runs/attempts, budgets, usage/pricing, egress audit, checkpoints, retention, restore readiness, skills, rules, proposals, approvals, and typed UI intents
• default-deny registered GraphQL tools with static disclosure schemas, current-principal rehydration, exact egress and atomic-budget proofs, logical local/private targets, and execution through authenticated resolvers
• native OpenAI, Anthropic, xAI, Ollama, explicitly profiled OpenAI-compatible, deterministic mock, and installed local-harness provider boundaries
• bounded supervised coordination, one-owner approval handoff, exact protected checkpoint adoption, and conservative recovery for ambiguous external effects
• verified OpenAI webhook intake and exact initial OpenAI background submission binding
• ordered bounded retention and verified deleting-session shell finalization
• content-free operational telemetry and authoritative immutable provider-call pricing
• release governance, PascalCase SDL coverage, self-owning disposable PostgreSQL parity, and compile-only MSSQL support

The crate contains no product-specific entity, route, tenant policy, deployment topology, arbitrary model-authored GraphQL, raw application repository access, or raw SQL.

Latest milestone: 0.50.0 / schema 0.47.0

Commit 9d81835e9d5d3f3ac399b42208937d5dd5f4daff adds exact initial native OpenAI background submission:

• introduces one private deterministic submission binding, bringing the AI schema to 40 entities
• rehydrates current authority and validates the exact run, attempt, fence, native profile, model, request, budget reservation, egress proof, retention mode, output ceiling, and provider storage choice
• prepares the binding durably, marks the reservation uncertain immediately before transport, and periodically heartbeats the exact fence while awaiting acknowledgement
• sends exactly one non-streaming background: true initial request with no tools, attachments, or continuation; the create boundary is never retried
• validates a bounded, content-free acknowledgement and exact opaque metadata echo before atomically binding the provider response
• parks accepted work lease-free in WaitingProvider
• releases unused reserved capacity for failures known to precede transport
• closes ambiguous transport or acknowledgement outcomes as RecoveryRequired with the immutable run-attempt outcome in the same transaction
• extends restore fatality facts and makes restored waiting work require recovery rather than replay

This milestone does not retrieve provider output, reconcile webhook receipts, settle provider usage, persist assistant output, or complete/requeue a run. Those powers remain closed pending an independently authorized and fenced reconciler.

The previous 0.49.0 milestone added bounded raw-body OpenAI webhook verification and deterministic, idempotent, content-free receipt intake. Supported receipts intentionally remain pending reconciliation.

Security invariants

• discovery, registration, approval, checkpoint possession, webhook delivery, and background acknowledgement never grant resolver, provider, retrieval, or egress authority
• current principal/scope policy is rehydrated around provider, approval, resolver, checkpoint, retention, and long-running boundaries
• provider disclosure requires exact egress and atomic-budget proofs; application results require fingerprint-bound static disclosure
• consequential execution is one-shot; ambiguity enters recovery and never replays a mutation
• every durable/provider result is fenced; stale workers cannot persist or finalize
• webhook verification is bounded and precedes JSON parsing; raw bodies, signatures, secrets, prompts, output, and provider errors are not persisted
• restore keeps runtime startup closed until migration and reconciliation facts are valid

Impact and migration

• crate version advances to 0.50.0
• AI schema module advances to 0.47.0 and owns 40 private entities
• the generated migration adds the background-submission table and exact uniqueness/binding metadata; existing 0.46 rows need no rewrite
• public provider/runtime seams gain default-deny background submission types and methods
• AiRunState gains WaitingProvider
• restore fact collectors must populate the serde-defaulted invalid-background-submission count
• there is no public GraphQL SDL, application table, credential persistence, provider output retrieval, or application-data migration in this milestone

Verification

Passed locally for the 0.50.0 checkpoint:

• formatting and diff checks
• committed release-policy gate against 0.49.0
• complete SQLite/provider/local-harness matrix: 149 unit tests discovered, 148 passed, and only the explicit live OpenAI smoke test ignored; all integration tests passed
• warnings-denied all-target Clippy
• warnings- and missing-docs-denied Rustdoc for full provider and PascalCase feature sets
• PascalCase GraphQL naming contract
• compile-only PostgreSQL plus OpenAI and MSSQL plus OpenAI checks
• backend-driver isolation for SQLite, PostgreSQL, MSSQL, and combined SQLite/PostgreSQL builds
• Cargo SemVer comparison against 0.49.0
• package-file, dependency-identity, and tracked-diff privacy review

No live/shared database, application integration suite, or live provider credential was used.

Current blocker

The owned-disposable-PostgreSQL prior-schema-to-current-schema rehearsal remains intentionally enabled and currently fails in the pinned graphql-orm 0.9.0 migration planner. PostgreSQL introspection reports constraint-backing unique indexes as ordinary indexes, so a repeated generated migration attempts an invalid DROP INDEX for an index owned by a table constraint.

This must be fixed and reviewed in graphql-orm, followed by an exact dependency repin and a successful owned-container upgrade rehearsal here. The draft does not weaken the test or add downstream SQL workarounds. Until that repin and green branch CI, the 0.50.0 checkpoint is durable on GitHub but is not release-ready.

Next slices

1. Integrate the reviewed upstream constraint-index introspection fix and rerun the full release matrix.
2. Add exact background response/receipt reconciliation with independent authority, budget, egress, retention, usage, protected-output, and atomic-finalization proofs.
3. Add provider-persistent file upload/search.
4. Complete multi-call, mixed, parallel, and stateless supervised ordering proofs.
5. Continue RAG/vector retrieval, MCP/ACP, backup execution, and MSSQL parity.

[Dastari]

Upstream alignment: Dastari/agql-auth#1 provides 0.9.0 and Dastari/graphql-orm#1 provides 0.7.0. This PR pins their exact reviewed commits. Merge order is auth, ORM, then this PR. If either upstream PR is squash- or rebase-merged, repin this manifest and CI to the resulting main commit before the next merge.

[Dastari]

Dependency-facing documentation audit complete: README.md reflects the implemented runtime and exact upstream versions; CHANGELOG.md records the new APIs and behaviors; MIGRATION.md documents Rust, GraphQL, persistence, authorization, restore, and explicit no-data-migration cases; detailed guides are indexed from docs/README.md; and Rustdoc succeeds with both warnings and missing-public-docs denied. The final CI correction reconstructs the unpublished 0.1.0 baseline dependency universe before SemVer comparison.

[Dastari]

The final documentation policy is now enforced in source and CI: public/runtime changes must update README.md, CHANGELOG.md, and MIGRATION.md together; public crate version and persistent schema-module version movement remain checked; and both provider/OpenAI and PascalCase Rustdoc jobs deny warnings plus missing public documentation. The migration guide explicitly records that this governance change needs no consumer or data migration.

[Dastari]

Multi-repository ownership is now explicit: this repository treats agql-auth and graphql-orm as read-only, stages copy-ready upstream requests in an ignored .handoffs directory, and repins only final reviewed upstream commits in dependency order. README, CHANGELOG.md, MIGRATION.md, AGENTS.md, the documentation index, and the new upstream contribution guide are synchronized; this governance change has no consumer or data migration.

[Dastari]

Final upstream release alignment is pushed. graphql-orm-ai now pins agql-auth 0.10.0 at c92dcb441237bbe308499b26525945f60ffa394a and graphql-orm 0.7.0 at 1e145a124e9e3f1b0ffd70165289170b627ecb73 in Cargo, Cargo.lock, and CI. README, CHANGELOG.md, MIGRATION.md, and getting-started guidance describe the final release boundary and the auth-only nullable OIDC authorization_policy migration; the AI schema and persisted AI data are unchanged. The complete local test, backend-compile, Clippy, Rustdoc, SemVer, and package-sanitization matrix passed without a database.