fix(db): preserve applied migration checksums

crates/corpus-core/src/db.rs

@@ -139,4 +139,19 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn applied_agent_migration_checksum_is_immutable() {
+        use sha2::{Digest, Sha256};
+        use std::{fs, path::Path};
+
+        let migration =
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("../../migrations/0002_agents.sql");
+        let checksum = hex::encode(Sha256::digest(fs::read(migration).expect("read migration")));
+
+        assert_eq!(
+            checksum, "45f16bac4c5d1021f7ed9636ebfa203767b828807bbaf53b7f6f53d2aeebb8d1",
+            "migration 0002 is already applied in production and must not be edited"
+        );
+    }
 }

migrations/0002_agents.sql

@@ -1,12 +1,9 @@
 -- Milestone 1: agent enrollment, identity, and health (spec 10.1, 10.11).
--- Tenant-scoped like every other data table (0001 tenant registry).
---
--- Agent enrollment tokens, agent rows, heartbeats, and coverage gaps.
 
 -- One-time enrollment tokens minted by operators via corpusctl.
 CREATE TABLE enrollment_token (
   token_sha256        bytea PRIMARY KEY,
-  tenant_id           uuid NOT NULL REFERENCES tenant (id),
+  tenant_id           uuid NOT NULL,
   label               text NOT NULL DEFAULT '',
   created_at          timestamptz NOT NULL,
   expires_at          timestamptz,
@@ -18,7 +15,7 @@ CREATE TABLE enrollment_token (
 -- plaintext token is shown exactly once at enrollment.
 CREATE TABLE agent (
   id                  uuid PRIMARY KEY,
-  tenant_id           uuid NOT NULL REFERENCES tenant (id),
+  tenant_id           uuid NOT NULL,
   host_name           text NOT NULL,
   token_sha256        bytea NOT NULL,
   version             text NOT NULL,

migrations/0013_agent_tenant_foreign_keys.sql

@@ -0,0 +1,23 @@
+-- Keep migration 0002 immutable; add tenant referential integrity separately.
+-- NOT VALID avoids blocking startup on legacy rows while enforcing the
+-- relationship for all new writes. The constraints can be validated after
+-- existing data is audited.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'enrollment_token_tenant_id_fkey'
+  ) THEN
+    ALTER TABLE enrollment_token
+      ADD CONSTRAINT enrollment_token_tenant_id_fkey
+      FOREIGN KEY (tenant_id) REFERENCES tenant (id) NOT VALID;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'agent_tenant_id_fkey'
+  ) THEN
+    ALTER TABLE agent
+      ADD CONSTRAINT agent_tenant_id_fkey
+      FOREIGN KEY (tenant_id) REFERENCES tenant (id) NOT VALID;
+  END IF;
+END $$;