Problem
The queue-identity work in #650 / #677 introduced a statement-level trigger that collects and compares old/new task rows on every step_tasks update. It protects queue snapshots, but ordinary status/output updates pay for the check even though pgflow does not change task queue identity at runtime.
The approved rewrite of #650 excludes that trigger; its replacement implementation starts from main, not by patching #677. Track database-enforced immutability here as a separate enhancement, not a prerequisite or release gate for #650/#651/#653. Existing foreign keys, uniqueness, and value constraints remain in those features.
Enhancement
Define and enforce a small, explicit immutability policy for persisted pgflow identities and task queue snapshots. Choose the field list before implementation; do not expand this into a generic schema-policy framework.
- Identify exactly which fields must never change after insertion. Review flow/step identity, task address, and
step_tasks.queue_name; do not assume every definition option is immutable.
- Choose the simplest enforcement mechanism that fits supported SQL APIs and roles. Consider privileges and column-specific checks before broad triggers.
- Reject forbidden identity changes without adding transition-table comparisons to ordinary task status/output updates.
- State the scope of enforcement: supported application writes, not protection against a database owner who can disable safeguards. Document any deliberate maintenance exception. Do not add an exception registry or maintenance bypass API without an existing supported operation that needs it.
Acceptance criteria
- The immutable fields and permitted mutation paths are explicit.
- Tests cover rejected identity changes and successful normal task lifecycle updates.
- Check the effect on single-task and bulk updates; avoid an unconditional per-update scan of old/new task row sets.
No mutable-routing API, generic auditing framework, or automatic repair is needed.
Problem
The queue-identity work in #650 / #677 introduced a statement-level trigger that collects and compares old/new task rows on every
step_tasksupdate. It protects queue snapshots, but ordinary status/output updates pay for the check even though pgflow does not change task queue identity at runtime.The approved rewrite of #650 excludes that trigger; its replacement implementation starts from
main, not by patching #677. Track database-enforced immutability here as a separate enhancement, not a prerequisite or release gate for #650/#651/#653. Existing foreign keys, uniqueness, and value constraints remain in those features.Enhancement
Define and enforce a small, explicit immutability policy for persisted pgflow identities and task queue snapshots. Choose the field list before implementation; do not expand this into a generic schema-policy framework.
step_tasks.queue_name; do not assume every definition option is immutable.Acceptance criteria
No mutable-routing API, generic auditing framework, or automatic repair is needed.