Upload folder using huggingface_hub

alembic/env.py

@@ -10,8 +10,35 @@ sys.path.append(str(Path(__file__).parent.parent))
 
 from app.database.base import Base
 from app.database import models_intents
+from app.database import models_onchain
 from app.core.config import settings
 
+# Tables that are deliberately not ORM-mapped. UsageTracker and arf-gateway
+# create and query these with raw SQL -- the Go service needs them without
+# going through Python at all -- so they have no entry in Base.metadata.
+# Autogenerate compares the database against that metadata, so without this
+# it sees them as tables to DROP.
+#
+# models_onchain is imported above for the same reason: it was missing, and
+# `alembic check` duly proposed dropping onchain_rationales.
+
+UNMANAGED_TABLES = {
+    "api_keys",
+    "monthly_counts",
+    "usage_log",
+    "idempotency_keys",
+}
+
+
+def include_object(object_, name, type_, reflected, compare_to):
+    """Keep unmanaged tables out of autogenerate/check comparisons."""
+    if type_ == "table" and name in UNMANAGED_TABLES:
+        return False
+    if type_ == "index" and getattr(object_, "table", None) is not None:
+        return object_.table.name not in UNMANAGED_TABLES
+    return True
+
+
 config = context.config
 # fileConfig defaults to disable_existing_loggers=True, which silences every
 # logger that already exists -- including the application's own. That is
@@ -36,6 +63,7 @@ def run_migrations_offline() -> None:
         target_metadata=target_metadata,
         literal_binds=True,
         dialect_opts={"paramstyle": "named"},
+        include_object=include_object,
     )
 
     with context.begin_transaction():
@@ -52,7 +80,9 @@ def run_migrations_online() -> None:
 
     with connectable.connect() as connection:
         context.configure(
-            connection=connection, target_metadata=target_metadata
+            connection=connection,
+            target_metadata=target_metadata,
+            include_object=include_object,
         )
 
         with context.begin_transaction():

alembic/versions/f1a2b3c4d5e6_add_tenant_id_to_intents_and_beta_state.py

@@ -0,0 +1,125 @@
+"""add tenant_id to intents and beta_state, and fix the beta_state unique index
+
+The models have declared `tenant_id` on both tables since multi-tenancy
+landed, but no migration ever created the column. Nothing caught it: the
+test suite builds its schema with `create_all` from the models, so tests
+see a column production does not have, and the migration check only
+asserted that `alembic upgrade head` *succeeds* -- never that the schema it
+produces matches the models.
+
+Production surfaced it the moment `intents` first existed (arf-api-004 had
+been rolling the whole chain back, hiding this behind a missing table):
+
+    psycopg2.errors.UndefinedColumn:
+    column intents.tenant_id does not exist
+
+Also corrects `ix_beta_state_category`, which d36deffe7fa2 created as
+UNIQUE on `category` alone. That is wrong for a multi-tenant table -- it
+lets exactly one tenant hold any given category, and the second tenant to
+write one gets an integrity error. The model's intent is the composite
+`uq_beta_state_tenant_category` on (tenant_id, category).
+
+Both columns are declared NOT NULL in the models. This adds them nullable,
+then tightens to NOT NULL only when no NULL rows remain, so the migration
+cannot fail on a database that already holds rows -- a failure here would
+abort the whole chain in a single transaction, which is exactly the
+arf-api-004 outage. A database left with NULLs keeps the column nullable
+and says so in the deploy log rather than taking the service down.
+
+Revision ID: f1a2b3c4d5e6
+Revises: 0c89c9727bc0
+Create Date: 2026-09-14 14:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'f1a2b3c4d5e6'
+down_revision: Union[str, Sequence[str], None] = '0c89c9727bc0'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _add_tenant_id(table: str, index_name: str, fk_name: str) -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    columns = {c['name'] for c in inspector.get_columns(table)}
+    if 'tenant_id' not in columns:
+        op.add_column(table, sa.Column('tenant_id', sa.String(length=64), nullable=True))
+
+    indexes = {ix['name'] for ix in inspector.get_indexes(table)}
+    if index_name not in indexes:
+        op.create_index(index_name, table, ['tenant_id'], unique=False)
+
+    fks = {fk.get('name') for fk in inspector.get_foreign_keys(table)}
+    if fk_name not in fks:
+        op.create_foreign_key(fk_name, table, 'tenants', ['tenant_id'], ['id'], ondelete='CASCADE')
+
+    # Tighten to NOT NULL only if nothing would violate it. On an empty or
+    # fully-populated table this reaches the models' declared schema; on a
+    # table with legacy NULLs it stays nullable instead of aborting the
+    # entire migration transaction.
+    orphans = bind.execute(
+        sa.text(f"SELECT COUNT(*) FROM {table} WHERE tenant_id IS NULL")  # noqa: S608
+    ).scalar()
+    if orphans:
+        print(
+            f"[{revision}] {table}: {orphans} row(s) have a NULL tenant_id; "
+            f"leaving the column nullable. Backfill them and then run "
+            f"ALTER TABLE {table} ALTER COLUMN tenant_id SET NOT NULL."
+        )
+        return
+    op.alter_column(table, 'tenant_id', existing_type=sa.String(length=64), nullable=False)
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    _add_tenant_id('intents', 'ix_intents_tenant_id', 'fk_intents_tenant_id')
+    _add_tenant_id('beta_state', 'ix_beta_state_tenant_id', 'fk_beta_state_tenant_id')
+
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    # d36deffe7fa2 made this UNIQUE on category alone, which is wrong once
+    # the table is partitioned by tenant. Recreate it non-unique and put the
+    # uniqueness on (tenant_id, category), as the model declares.
+    beta_indexes = {ix['name']: ix for ix in inspector.get_indexes('beta_state')}
+    category_index = beta_indexes.get('ix_beta_state_category')
+    if category_index is not None and category_index.get('unique'):
+        op.drop_index('ix_beta_state_category', table_name='beta_state')
+        op.create_index('ix_beta_state_category', 'beta_state', ['category'], unique=False)
+
+    constraints = {uc['name'] for uc in inspector.get_unique_constraints('beta_state')}
+    constraints |= set(beta_indexes)
+    if 'uq_beta_state_tenant_category' not in constraints:
+        op.create_unique_constraint(
+            'uq_beta_state_tenant_category', 'beta_state', ['tenant_id', 'category']
+        )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if 'uq_beta_state_tenant_category' in {
+        uc['name'] for uc in inspector.get_unique_constraints('beta_state')
+    }:
+        op.drop_constraint('uq_beta_state_tenant_category', 'beta_state', type_='unique')
+
+    for table, index_name, fk_name in (
+        ('beta_state', 'ix_beta_state_tenant_id', 'fk_beta_state_tenant_id'),
+        ('intents', 'ix_intents_tenant_id', 'fk_intents_tenant_id'),
+    ):
+        insp = sa.inspect(bind)
+        if fk_name in {fk.get('name') for fk in insp.get_foreign_keys(table)}:
+            op.drop_constraint(fk_name, table, type_='foreignkey')
+        if index_name in {ix['name'] for ix in insp.get_indexes(table)}:
+            op.drop_index(index_name, table_name=table)
+        if 'tenant_id' in {c['name'] for c in insp.get_columns(table)}:
+            op.drop_column(table, 'tenant_id')