feat: make schema sync and source-of-truth enforcement first-class

.cargo/config.toml

@@ -6,6 +6,7 @@ incremental = true
 pipelining = true
 # Use all available CPU cores for compilation
 jobs = 24
+rustc-workspace-wrapper = "scripts/rustc_wrapper.sh"
 
 # Shared build cache across the workspace (experimental)
 [unstable]
@@ -53,8 +54,8 @@ cf = [
   "--features",
 ] # Check with features
 
-[env]
 # Environment variables for coverage and testing
+[env]
 CARGO_LLVM_COV_TARGET_DIR = { value = "target/llvm-cov", relative = true }
 
 # Speed optimizations via environment variables

.config/nextest.toml

@@ -16,6 +16,7 @@ retries = 1
 # Simple timeout - if a test takes more than 2 minutes, something is wrong
 slow-timeout = { period = "120s", terminate-after = 1 }
 
+
 # Better failure reporting
 [profile.default.junit]
 path = "target/nextest/junit.xml"
@@ -30,6 +31,7 @@ success-output = "never"
 retries = 0
 slow-timeout = { period = "60s", terminate-after = 1 }
 
+
 # Reliable profile for CI - more retries, limited parallelism
 [profile.reliable]
 test-threads = 2
@@ -38,6 +40,7 @@ success-output = "never"
 retries = 3
 slow-timeout = { period = "180s", terminate-after = 1 }
 
+
 # Debug profile - show all output
 [profile.debug]
 test-threads = 1
@@ -46,6 +49,7 @@ success-output = "immediate-final"
 retries = 0
 slow-timeout = { period = "300s", terminate-after = 1 }
 
+
 # Parallel profile - maximum parallelism for speed
 [profile.parallel]
 # Use all available CPUs for maximum speed
@@ -58,6 +62,7 @@ retries = 0
 # Shorter timeout for parallel execution
 slow-timeout = { period = "60s", terminate-after = 1 }
 
+
 # CI parallel profile - balanced for reliability with good parallelism
 [profile.ci-parallel]
 # Use 75% of CPUs to leave headroom for system
@@ -66,4 +71,4 @@ failure-output = "immediate-final"
 success-output = "never"
 # One retry for flaky tests
 retries = 1
-slow-timeout = { period = "120s", terminate-after = 1 }
+slow-timeout = { period = "120s", terminate-after = 1 }

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
 
     services:
       postgres:
-        image: timescale/timescaledb-ha:pg16-latest
+        image: timescale/timescaledb:2.15.2-pg16  # Pin exact Timescale/Postgres versions for deterministic CI
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -54,6 +54,21 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Enforce forbidden pattern guards
+      run: bash scripts/check_forbidden_patterns.sh
+
+    - name: Regenerate schemas and ensure repository is clean
+      # Treat schemas/ like a generated artifact (similar to cargo fmt).
+      env:
+        DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
+      run: |
+        ./scripts/schema-dev.sh generate
+        if ! git diff --quiet -- schemas; then
+          echo "::error::Schema artifacts are stale. Run './scripts/schema-dev.sh generate' and commit the results."
+          git status schemas
+          exit 1
+        fi
+
     - name: Install Rust
       uses: actions-rs/toolchain@v1
       with:
@@ -90,21 +105,22 @@ jobs:
       env:
         DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
       run: |
-        cd crate/sinex-db/migration && cargo run -- up
+        cd crate/lib/sinex-schema
+        cargo run -- up
 
     - name: Run tests
       env:
         DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
         RUST_LOG: debug
-      run: cargo test --all-features
+      run: cargo nextest run --all-features --workspace
 
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
 
     services:
       postgres:
-        image: timescale/timescaledb-ha:pg16-latest
+        image: timescale/timescaledb:2.15.2-pg16  # Pin exact Timescale/Postgres versions for deterministic CI
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -120,6 +136,21 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Enforce forbidden pattern guards
+      run: bash scripts/check_forbidden_patterns.sh
+
+    - name: Regenerate schemas and ensure repository is clean
+      # Treat schemas/ like a generated artifact (similar to cargo fmt).
+      env:
+        DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
+      run: |
+        ./scripts/schema-dev.sh generate
+        if ! git diff --quiet -- schemas; then
+          echo "::error::Schema artifacts are stale. Run './scripts/schema-dev.sh generate' and commit the results."
+          git status schemas
+          exit 1
+        fi
+
     - name: Install Rust
       uses: actions-rs/toolchain@v1
       with:
@@ -149,7 +180,8 @@ jobs:
       env:
         DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
       run: |
-        cd crate/sinex-db/migration && cargo run -- up
+        cd crate/lib/sinex-schema
+        cargo run -- up
 
     - name: Generate code coverage
       env:
@@ -160,4 +192,4 @@ jobs:
       uses: codecov/codecov-action@v3
       with:
         files: lcov.info
-        fail_ci_if_error: false
+        fail_ci_if_error: false

.github/workflows/schema-compatibility.yml

@@ -3,9 +3,9 @@ name: Schema Compatibility Check
 on:
   pull_request:
     paths:
-      - 'crate/sinex-events/src/payloads/**'
-      - 'crate/sinex-events/src/event.rs'
-      - 'crate/sinex-macros/src/event_payload.rs'
+      - 'schemas/**'
+      - 'crate/lib/sinex-core/src/types/events/**'
+      - 'scripts/check-schema-compatibility.sh'
 
 jobs:
   check-schemas:
@@ -29,15 +29,6 @@ jobs:
           chmod +x scripts/check-schema-compatibility.sh
           CI_BASE_BRANCH=${{ github.base_ref }} ./scripts/check-schema-compatibility.sh
 
-      - name: Generate schema report
-        if: always()
-        run: |
-          echo "## Schema Compatibility Report" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ -f schema-report.md ]; then
-            cat schema-report.md >> $GITHUB_STEP_SUMMARY
-          fi
-
       - name: Comment on PR
         if: failure()
         uses: actions/github-script@v7
@@ -47,9 +38,8 @@ jobs:
             ❌ **Schema Compatibility Check Failed**
 
             Please ensure:
-            - Version numbers are incremented for breaking changes
-            - \`evolves_from\` is specified for major version changes
-            - Breaking changes are documented with \`breaking_change\` attribute
+            - Any breaking changes get a schema version bump
+            - Optional additions remain backward compatible
 
             Run \`./scripts/check-schema-compatibility.sh\` locally for details.
             `;
@@ -59,4 +49,4 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: message
-            });
+            });

.github/workflows/schema-management.yml

@@ -4,14 +4,16 @@ on:
   push:
     branches: [ master, 'claude/**' ]
     paths:
-      - 'crate/sinex-events/src/**/*.rs'
+      - 'crate/lib/sinex-core/src/types/events/**/*.rs'
       - 'schemas/**/*.json'
+      - 'scripts/schema-dev.sh'
       - '.github/workflows/schema-management.yml'
   pull_request:
     branches: [ master ]
     paths:
-      - 'crate/sinex-events/src/**/*.rs'
+      - 'crate/lib/sinex-core/src/types/events/**/*.rs'
       - 'schemas/**/*.json'
+      - 'scripts/schema-dev.sh'
       - '.github/workflows/schema-management.yml'
 
 jobs:
@@ -59,9 +61,9 @@ jobs:
           name: sinex
           skipPush: true
 
-      - name: Generate schemas
+      - name: Generate schemas via CLI
         run: |
-          nix develop --command cargo run --package sinex-events --bin generate-schemas
+          nix develop --command ./scripts/schema-dev.sh generate
 
       - name: Check for schema changes
         id: check-changes
@@ -84,53 +86,11 @@ jobs:
           git commit -m "chore: update generated schemas [skip ci]"
           git push
 
-  check-compatibility:
-    name: Check Schema Compatibility
-    runs-on: ubuntu-latest
-    needs: generate-schemas
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Install json-schema-diff
-        run: npm install -g json-schema-diff
-
-      - name: Check backward compatibility
-        run: |
-          echo "Checking schema backward compatibility..."
-          BASE_BRANCH="${{ github.base_ref }}"
-
-          # Get list of schema files that exist in both branches
-          git ls-tree -r origin/$BASE_BRANCH --name-only | grep "^schemas/.*\.json$" | while read schema_path; do
-            if [ -f "$schema_path" ]; then
-              echo "Checking compatibility for: $schema_path"
-
-              # Get schema from base branch
-              git show origin/$BASE_BRANCH:$schema_path > /tmp/base_schema.json
-
-              # Compare schemas
-              if ! json-schema-diff /tmp/base_schema.json $schema_path; then
-                echo "⚠️  Breaking change detected in $schema_path"
-                echo "Consider incrementing the schema version if this is intentional"
-                exit 1
-              fi
-            fi
-          done
-
-          echo "✅ All schema changes are backward compatible"
-
   deploy-schemas:
     name: Deploy Schemas to Database
     runs-on: ubuntu-latest
     needs: [validate-schemas, generate-schemas]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master' && secrets.SINEX_PROD_DATABASE_URL != ''
     steps:
       - uses: actions/checkout@v4
 
@@ -142,7 +102,7 @@ jobs:
             experimental-features = nix-command flakes
 
       - name: Deploy schemas
+        env:
+          DATABASE_URL: ${{ secrets.SINEX_PROD_DATABASE_URL }}
         run: |
-          echo "🚀 Deploying schemas to production database..."
-          echo "Note: This step requires the deployment script to be implemented"
-          # nix develop --command ./scripts/deploy-schemas.sh
+          nix develop --command ./scripts/deploy-schemas.sh