feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02) (#206)

compliance-agent/src/database.rs

@@ -465,6 +465,34 @@ impl Database {
             )
             .await?;
 
+        // werkbank_jobs: unique job id (idempotent enqueue by job id)
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "job.id": 1 })
+                    .options(IndexOptions::builder().unique(true).build())
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: lease query — oldest queued job for an executor
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: visibility-timeout sweep of expired leases
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
+                    .build(),
+            )
+            .await?;
+
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -563,6 +591,12 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
+    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
+    /// control plane enqueues and runners lease.
+    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
+        self.inner.collection("werkbank_jobs")
+    }
+
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)