{
  "version": 1,
  "migrations": {
    "apps/api/migrations/0090_oidc_multi_tenant_identity.sql": {
      "sha256": "d5e67a0f92f4fe5fb64f5caceef0dd4733dc65f921e309bf4b3288522f6b4876",
      "allowedViolations": [
        "destructive DROP operation",
        "non-null column addition"
      ],
      "reason": "The migration replaces two existing constraints and one index with expanded definitions. Production preflight confirmed six schema-v1 identity revisions, no OIDC sessions or revocation watermarks, and small affected relations; the non-null columns use constant defaults."
    },
    "apps/api/migrations/0093_worker_instance_capacity_limit.sql": {
      "sha256": "4b6a39ef90e7032555739ccf0568bf7ae0bce23ef98c3bee9c2c8e3bfa13291e",
      "allowedViolations": [
        "non-null column addition"
      ],
      "reason": "The table stores ephemeral Worker heartbeats and currently has only two production rows. PostgreSQL adds the integer column with a constant default, then the migration backfills each live row from its existing allocation so a rolling deployment cannot assign unsafe failover capacity."
    },
    "apps/api/migrations/0095_oidc_session_context_identity.sql": {
      "sha256": "3e6d17b5b564047c4a77ef3e4cf4ed88caba375a34a33bc7ecfbd7c59d6ab479",
      "allowedViolations": [
        "destructive DROP operation",
        "non-null column addition"
      ],
      "reason": "The migration adds only nullable session identity columns, backfills bound sessions, and replaces one CHECK constraint without dropping data. Production preflight on 2026-07-31 found zero gateway_oidc_sessions rows and a 48 KiB relation, so the constraint validation and metadata lock are bounded; the non-null finding comes from the new CHECK expression rather than a NOT NULL column addition."
    },
    "apps/api/migrations/0096_worker_capacity_controller.sql": {
      "sha256": "52c2c5f31eaa61b96508ae9b2c9fa164e0f1544184c55a1ba85f64b9aca442cb",
      "allowedViolations": [
        "destructive DROP operation"
      ],
      "reason": "The migration replaces only the existing Worker status CHECK constraint so a rolling deployment can mark lost instances stale. It does not drop data, columns, tables, or indexes; the old and new binaries both continue to read active and draining rows safely."
    },
    "apps/api/migrations/0101_worker_adaptive_load.sql": {
      "sha256": "4a23a194b9244f0afe245ceb8ff47ee03ca7d3e732e5593f731380bdf3dd77ae",
      "allowedViolations": [
        "non-null column addition"
      ],
      "reason": "The adaptive Worker columns use constant defaults on gateway_worker_instances, so PostgreSQL 18 can add them without rewriting the table. Production preflight on 2026-08-03 found 96 rows and a 180224-byte relation; the explicit backfill and constraint validation are therefore bounded. The only change to the 31899648-byte gateway_concurrency_leases relation is a nullable numeric column and a NOT VALID check followed by validation."
    },
    "apps/api/migrations/0102_access_rule_allow_whitelist_semantics.sql": {
      "sha256": "7f65855237b7e5ae38b6d80228bf446e5c28eb22956272ced15c9f492b9aad40",
      "allowedViolations": [
        "procedural SQL body",
        "DELETE FROM operation"
      ],
      "reason": "This one-time semantic migration takes a write-blocking/read-compatible lock, records count and SHA-256 manifests, archives every legacy allow row, verifies the archive, and only then deletes legacy allows. Deny rows are checksummed before cleanup and verified unchanged afterward. The procedural blocks make any count or checksum mismatch abort the transaction; reapplying after new whitelist writes also fails before deleting them."
    }
  }
}
