KArtSell.Aegis/scripts/phase1/template-approve-versionset.sql

-- Phase 1 Shadow Run — VersionSet approval TEMPLATE.
-- See docs/CURRENT/PHASE-1_APPROVAL_CHECKLIST.md before touching this file.
--
-- THIS IS NOT A SCRIPT TO RUN AS-IS. Every :placeholder below must be filled in by a real
-- person who actually reviewed the referenced evidence. Do not fill these in programmatically,
-- from a template default, or because "the checklist items are all checked" — the checker must
-- be a different person from the maker, and both must be named humans who can be held
-- accountable for the decision. Running this file IS the approval action.
--
-- Usage: fill in every :placeholder, remove this comment block, then run interactively:
--   psql "$KARTSELL_POSTGRES" -f scripts/phase1/template-approve-versionset.sql
-- Do not run non-interactively / in CI / from a job.

begin;

-- 1) Dataset manifest: propose, then (as a DIFFERENT session/person) approve + freeze.
insert into evaluation.dataset_manifest
    (dataset_id, scope_key, content_hash, source_catalog_version, lineage_hash, status, frozen_at)
values
    (:'dataset_id', :'scope_key', :'content_hash', :'source_catalog_version', :'lineage_hash',
     'PROPOSED', now());

-- -- Run as a SEPARATE step by the checker, after real review, not in the same transaction:
-- update evaluation.dataset_manifest
--    set status = 'APPROVED', approved_by = :'checker_name', approved_at = now()
--  where dataset_id = :'dataset_id';
-- -- table is append-only after that point; freezing requires a new row, not an UPDATE to FROZEN
-- -- (see db/migrations/0034_dataset_manifest_freeze_contract.sql trigger) — insert a follow-up
-- -- row with status = 'FROZEN' and the same content_hash lineage instead.

-- 2) Model version registry.
insert into governance.model_version_registry
    (model_version, scope_key, config_version, code_sha, contract_version, lifecycle_state,
     effective_at, model_card_hash)
values
    (:'model_version', :'scope_key', :'config_version', :'code_sha', :'contract_version',
     'CANDIDATE', now(), :'model_card_hash');

-- -- Checker step, separately, after real review:
-- update governance.model_version_registry
--    set lifecycle_state = 'APPROVED', approved_by = :'checker_name', approved_at = now()
--  where model_version = :'model_version' and scope_key = :'scope_key' and effective_at = :'effective_at';

-- 3) Evidence snapshot (references the approved dataset + model version above).
insert into signal_engine.evidence_snapshot
    (evidence_id, as_of, published_at_cutoff, dataset_id, data_hash, model_version,
     config_version, payload, content_hash)
values
    (:'evidence_id', now(), :'published_at_cutoff', :'dataset_id', :'data_hash',
     :'model_version', :'config_version', :'payload_json'::jsonb, :'content_hash');

-- 4) Release evidence bundle — maker creates, a DIFFERENT checker approves.
insert into governance.release_evidence_bundle
    (bundle_id, release_version, source_manifest_hash, build_artifact_hash, test_artifact_hash,
     migration_artifact_hash, security_artifact_hash, rollback_artifact_hash, decision_log_hash,
     status, maker_id, created_at, content_hash)
values
    (gen_random_uuid(), :'release_version', :'source_manifest_hash', :'build_artifact_hash',
     :'test_artifact_hash', :'migration_artifact_hash', :'security_artifact_hash',
     :'rollback_artifact_hash', :'decision_log_hash', 'REVIEW_REQUIRED', :'maker_name', now(),
     :'bundle_content_hash');

-- -- Checker step, separately, after real review (checker_id must differ from maker_id — enforced
-- -- by CHECK constraint):
-- update governance.release_evidence_bundle
--    set status = 'APPROVED', checker_id = :'checker_name', decided_at = now()
--  where bundle_id = :'bundle_id';

-- Do not COMMIT this transaction until you are the maker completing steps above as one unit.
-- The checker updates are separate transactions run later by a different person.
commit;