feat: implement operation log v2 phases 0-3

COMPATIBILITY.md

@@ -96,6 +96,15 @@ storage initialization would query, the global config DB is unnecessary and the
 command continues with a warning rather than `LBR-CONFIG-001`. The
 compatibility guard is pinned by `compat_global_config_schema_future`.
 
+## Operation Log storage migration
+
+The development Operation Log v2 replaces the v1 `operation_view*` tables with
+the eight-table operation/change/journal schema. This is a forward-only schema
+replacement in the current development line; v1 audit rows are not maintained
+through a long-term compatibility adapter. The public `libra op` command
+surface remains intentionally different from Git and will consume the v2
+store as the later operation tasks land.
+
 ## Top-level commands (from `src/cli.rs`)
 
 | Command | Tier | Notes |

Cargo.toml

@@ -275,6 +275,34 @@ path = "tests/compat/compat_ledger_schema.rs"
 name = "compat_version_surface_sync"
 path = "tests/compat/version_surface_sync.rs"
 
+[[test]]
+name = "operation_v2_schema"
+path = "tests/operation_v2_schema.rs"
+
+[[test]]
+name = "operation_dag"
+path = "tests/operation_dag.rs"
+
+[[test]]
+name = "workspace_snapshot_roundtrip"
+path = "tests/workspace_snapshot_roundtrip.rs"
+
+[[test]]
+name = "index_snapshot_roundtrip"
+path = "tests/index_snapshot_roundtrip.rs"
+
+[[test]]
+name = "sequencer_snapshot_roundtrip"
+path = "tests/sequencer_snapshot_roundtrip.rs"
+
+[[test]]
+name = "operation_command_coverage"
+path = "tests/operation_command_coverage.rs"
+
+[[test]]
+name = "agent_shell_operation"
+path = "tests/agent_shell_operation.rs"
+
 [[test]]
 name = "compat_r0_9_doc_closeout"
 path = "tests/compat/r0_9_doc_closeout.rs"

docs/development/commands/op.md

@@ -19,10 +19,13 @@ extension rather than a Git command. The current public surface supports:
 
 - CLI entry: `src/cli.rs::Commands::Op`.
 - Command implementation: `src/command/op.rs`.
-- Storage/service layer: `src/internal/operation.rs`.
+- Storage/service layer: `src/internal/operation.rs` (legacy service) and the
+  v2 schema entities under `src/internal/model/`.
 - Transaction wrapper: `src/internal/operation_wrapper.rs`.
-- Operation tables are part of the bootstrap schema and are also ensured by the
-  explicit database upgrade path for older repositories.
+- Operation Log v2 owns the eight tables `operation`, `operation_parent`,
+  `operation_head`, `operation_journal`, `change_identity`, `change_revision`,
+  `change_predecessor`, and `ai_operation_link`. The v1 view tables are removed
+  by the forward-only `operation_log_v2` migration.
 
 ## Current Behavior
 

sql/migrations/2026090301_operation_log_v2.sql

@@ -0,0 +1,125 @@
+-- Operation Log v2 (plan-20260822 OL-02).
+--
+-- Development-time replacement: the five v1 operation tables are removed and
+-- rebuilt as the eight v2 tables.  The migration is intentionally
+-- forward-only; repositories that need the old audit rows must export them
+-- before upgrading.  No prompt, transcript, secret, or other AI payload is
+-- present in this schema.
+
+DROP TABLE IF EXISTS `operation_view_workspace`;
+DROP TABLE IF EXISTS `operation_view_ref`;
+DROP TABLE IF EXISTS `operation_view`;
+DROP TABLE IF EXISTS `operation_journal`;
+DROP TABLE IF EXISTS `operation_head`;
+DROP TABLE IF EXISTS `operation_parent`;
+DROP TABLE IF EXISTS `operation`;
+DROP TABLE IF EXISTS `change_identity`;
+DROP TABLE IF EXISTS `change_revision`;
+DROP TABLE IF EXISTS `change_predecessor`;
+DROP TABLE IF EXISTS `ai_operation_link`;
+
+CREATE TABLE `operation` (
+    `op_id`               TEXT PRIMARY KEY,
+    `repo_id`             TEXT NOT NULL,
+    `format_version`      INTEGER NOT NULL DEFAULT 2,
+    `kind`                TEXT NOT NULL,
+    `status`              TEXT NOT NULL,
+    `command_name`        TEXT,
+    `description`         TEXT,
+    `args_digest`         TEXT,
+    `actor`               TEXT,
+    `worktree_id`         TEXT,
+    `scope_kind`          TEXT NOT NULL,
+    `pre_view_oid`        TEXT NOT NULL,
+    `post_view_oid`       TEXT NOT NULL,
+    `restores_op_id`      TEXT,
+    `reverts_op_id`       TEXT,
+    `predecessor_map_oid` TEXT,
+    `causal_context_id`   TEXT,
+    `start_ts`            INTEGER NOT NULL,
+    `end_ts`              INTEGER
+);
+CREATE INDEX `idx_operation_repo_order`
+    ON `operation`(`repo_id`, `end_ts` DESC, `start_ts` DESC, `op_id` DESC);
+CREATE INDEX `idx_operation_repo_scope_order`
+    ON `operation`(`repo_id`, `scope_kind`, `end_ts` DESC, `op_id` DESC);
+
+CREATE TABLE `operation_parent` (
+    `op_id`        TEXT NOT NULL,
+    `parent_op_id` TEXT NOT NULL,
+    `ordinal`      INTEGER NOT NULL,
+    PRIMARY KEY (`op_id`, `parent_op_id`)
+);
+CREATE INDEX `idx_operation_parent_parent`
+    ON `operation_parent`(`parent_op_id`, `op_id`);
+
+CREATE TABLE `operation_head` (
+    `repo_id`    TEXT NOT NULL,
+    `scope_key`  TEXT NOT NULL,
+    `op_id`      TEXT NOT NULL,
+    `generation` INTEGER NOT NULL,
+    PRIMARY KEY (`repo_id`, `scope_key`, `op_id`)
+);
+CREATE INDEX `idx_operation_head_generation`
+    ON `operation_head`(`repo_id`, `scope_key`, `generation` DESC);
+
+CREATE TABLE `operation_journal` (
+    `journal_id`       TEXT PRIMARY KEY,
+    `op_id`            TEXT NOT NULL,
+    `phase`            TEXT NOT NULL,
+    `pre_view_oid`     TEXT,
+    `target_view_oid`  TEXT,
+    `owner`            TEXT NOT NULL,
+    `updated_at`       INTEGER NOT NULL,
+    `recovery_payload` TEXT
+);
+CREATE INDEX `idx_operation_journal_op`
+    ON `operation_journal`(`op_id`, `updated_at` DESC);
+
+CREATE TABLE `change_identity` (
+    `change_id`    TEXT PRIMARY KEY,
+    `repo_id`      TEXT NOT NULL,
+    `origin`       TEXT NOT NULL,
+    `created_op_id` TEXT NOT NULL,
+    `created_at`   INTEGER NOT NULL
+);
+CREATE INDEX `idx_change_identity_repo`
+    ON `change_identity`(`repo_id`, `created_at` DESC);
+
+CREATE TABLE `change_revision` (
+    `change_id`        TEXT NOT NULL,
+    `commit_oid`       TEXT NOT NULL,
+    `created_op_id`    TEXT NOT NULL,
+    `visibility`       TEXT NOT NULL,
+    `revision_ordinal` INTEGER NOT NULL,
+    PRIMARY KEY (`change_id`, `commit_oid`)
+);
+CREATE INDEX `idx_change_revision_commit`
+    ON `change_revision`(`commit_oid`);
+
+CREATE TABLE `change_predecessor` (
+    `successor_oid`   TEXT NOT NULL,
+    `predecessor_oid` TEXT NOT NULL,
+    `op_id`           TEXT NOT NULL,
+    `relation_kind`   TEXT NOT NULL,
+    `ordinal`         INTEGER NOT NULL,
+    PRIMARY KEY (`successor_oid`, `predecessor_oid`, `op_id`)
+);
+CREATE INDEX `idx_change_predecessor_predecessor`
+    ON `change_predecessor`(`predecessor_oid`, `ordinal`);
+
+CREATE TABLE `ai_operation_link` (
+    `operation_id`             TEXT PRIMARY KEY,
+    `session_id`               TEXT,
+    `run_id`                   TEXT,
+    `tool_invocation_id`       TEXT,
+    `intent_id`                TEXT,
+    `repo_id`                  TEXT NOT NULL,
+    `worktree_id`              TEXT,
+    `workspace_id`             TEXT,
+    `lease_generation`         INTEGER,
+    `config_provenance_digest` TEXT,
+    `redaction_version`       TEXT NOT NULL
+);
+CREATE INDEX `idx_ai_operation_link_repo`
+    ON `ai_operation_link`(`repo_id`, `operation_id`);

sql/migrations/README.md

@@ -172,6 +172,7 @@ helpers in `db.rs`. Subsequent CEXes have populated this directory.
 | `2026081301`  | `approved_permission_provenance` | `2026081301_approved_permission_provenance{,_down}.sql` (plan-20260715 W4-07: Always-approval provenance columns; empty backfill; `project_id` not rewritten; down fail-closed with provenance or linked HEAD evidence.) |
 | `2026081801`  | `agent_bridge_capture` | `2026081801_agent_bridge_capture{,_down}.sql` (plan-20260818 LB-02: DeepSeek Harness bridge durable projection — `agent_bridge_session/event/operation/checkpoint/link`; source fixed to `deepseek-harness`, 256 KiB event payload CHECK, `(bridge_session_id,event_seq)` and `operation_id` idempotency; forward-only down that freezes while any bridge row exists and never deletes acked events/evidence.) |
 | `2026082401`  | `agent_bridge_link_relations` | `2026082401_agent_bridge_link_relations{,_down}.sql` (plan-20260818 LB-04/LB-05 VCS wiring: `agent_bridge_link` becomes a real relation graph — uniqueness moves to the full edge `(source_type,source_id,target_type,target_id)` so one result can carry its operation, workspace, parent-session and evidence associations, and `source_type` gains the mutation result kinds `commit`/`restore`/`review`; every existing edge is copied verbatim; forward-only down that freezes while any link row exists.) |
+| `2026090301`  | `operation_log_v2` | `2026090301_operation_log_v2.sql` (plan-20260822 OL-02: forward-only development-time replacement of the five v1 operation tables with the eight-table Operation Log v2 schema) |
 
 All registered migrations are loaded via `include_str!`. New migrations must
 follow the same pattern — inline SQL strings in `builtin_migrations()` are no

sql/sqlite_20260309_init.sql

@@ -86,7 +86,7 @@ CREATE INDEX IF NOT EXISTS idx_operation_repo_order
     ON `operation`(`repo_id`, `end_ts` DESC, `start_ts` DESC, `op_id` DESC);
 
 CREATE TABLE IF NOT EXISTS `operation_parent` (
-    `op_id` TEXT NOT NULL,
+    `op_id`        TEXT NOT NULL,
     `parent_op_id` TEXT NOT NULL,
     PRIMARY KEY (`op_id`, `parent_op_id`)
 );