Benjamin Admin
d5bcd0bd5b
New table: deployment_checks (verdict, blocking/warning controls, risk score)
New API:
POST /v1/deployment-checks (SDK asks: "can I deploy?")
GET /v1/deployment-checks/{id} (check result)
POST /v1/deployment-checks/{id}/override (manual override with justification)
GET /v1/deployment-checks/stats (approval/block rate)
Check logic: queries G1 decision_traces + G3 open failures per affected control.
Verdict: approved (0 blocking) or blocked (with fix recommendations).
454 tests pass, 0 regressions.
Block G complete: G1-G4 all implemented.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
39 lines
1.3 KiB
SQL
39 lines
1.3 KiB
SQL
-- Migration 009: Deployment Checks / Pre-Deployment Enforcement (G4)
|
|
-- Schema: compliance
|
|
-- Run: ssh macmini "docker exec -i bp-core-postgres psql -U breakpilot -d breakpilot_db" < control-pipeline/migrations/009_deployment_checks.sql
|
|
|
|
SET search_path TO compliance, public;
|
|
|
|
CREATE TABLE IF NOT EXISTS deployment_checks (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
tenant_id UUID NOT NULL,
|
|
|
|
-- Deploy Info
|
|
commit_hash VARCHAR(64) NOT NULL,
|
|
branch VARCHAR(200),
|
|
environment VARCHAR(50) DEFAULT 'production',
|
|
|
|
-- Result
|
|
verdict VARCHAR(20) NOT NULL DEFAULT 'pending'
|
|
CHECK (verdict IN ('pending', 'approved', 'blocked', 'override')),
|
|
|
|
-- Impact
|
|
affected_control_ids JSONB DEFAULT '[]',
|
|
blocking_controls JSONB DEFAULT '[]',
|
|
warning_controls JSONB DEFAULT '[]',
|
|
risk_score NUMERIC(5,2) DEFAULT 0.0,
|
|
|
|
-- Override
|
|
override_by VARCHAR(200),
|
|
override_reason TEXT,
|
|
|
|
summary TEXT,
|
|
metadata JSONB DEFAULT '{}',
|
|
created_at TIMESTAMPTZ DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_dc_tenant ON deployment_checks(tenant_id);
|
|
CREATE INDEX IF NOT EXISTS idx_dc_hash ON deployment_checks(commit_hash);
|
|
CREATE INDEX IF NOT EXISTS idx_dc_verdict ON deployment_checks(verdict);
|
|
CREATE INDEX IF NOT EXISTS idx_dc_created ON deployment_checks(created_at);
|