Harden production workflows and agent admission

server/monlet_server/models.py

@@ -5,6 +5,7 @@ from sqlalchemy import (
     JSON,
     Boolean,
     CheckConstraint,
+    Computed,
     DateTime,
     ForeignKey,
     Index,
@@ -51,11 +52,57 @@ class Agent(Base):
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )
+    accepted_key_hash: Mapped[str | None] = mapped_column(Text, nullable=True)
+    accepted_key_fingerprint: Mapped[str | None] = mapped_column(Text, nullable=True)
+    accepted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    pending_key_hash: Mapped[str | None] = mapped_column(Text, nullable=True)
+    pending_key_fingerprint: Mapped[str | None] = mapped_column(Text, nullable=True)
+    pending_hostname: Mapped[str | None] = mapped_column(Text, nullable=True)
+    pending_seen_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    pending_features: Mapped[dict | None] = mapped_column(_jsonb(), nullable=True)
+    pending_labels: Mapped[dict | None] = mapped_column(_jsonb(), nullable=True)
+    admission_rank: Mapped[int] = mapped_column(
+        Integer,
+        Computed("CASE WHEN pending_key_hash IS NOT NULL THEN 0 ELSE 1 END", persisted=True),
+        nullable=False,
+    )
 
     __table_args__ = (
         CheckConstraint("status IN ('alive','stale','dead')", name="agents_status_chk"),
         Index("agents_status_idx", "status"),
         Index("agents_last_seen_idx", "last_seen_at"),
+        Index("agents_admission_rank_idx", "admission_rank", "agent_id"),
+        Index("agents_hostname_idx", "hostname", unique=True),
+        Index(
+            "agents_accepted_key_hash_idx",
+            "accepted_key_hash",
+            unique=True,
+            postgresql_where=text("accepted_key_hash IS NOT NULL"),
+        ),
+        Index(
+            "agents_pending_key_hash_idx",
+            "pending_key_hash",
+            unique=True,
+            postgresql_where=text("pending_key_hash IS NOT NULL"),
+        ),
+    )
+
+
+class AgentBlacklist(Base):
+    __tablename__ = "agent_blacklist"
+
+    key_hash: Mapped[str] = mapped_column(Text, primary_key=True)
+    key_fingerprint: Mapped[str] = mapped_column(Text, nullable=False)
+    agent_id: Mapped[str] = mapped_column(Text, nullable=False)
+    hostname: Mapped[str] = mapped_column(Text, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    last_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+
+    __table_args__ = (
+        Index("agent_blacklist_fingerprint_idx", "key_fingerprint"),
+        Index("agent_blacklist_last_seen_idx", "last_seen_at"),
     )
 
 
@@ -117,6 +164,19 @@ class Event(Base):
         ),
         Index("events_observed_at_idx", text("observed_at DESC")),
         Index("events_received_at_idx", text("received_at DESC")),
+        Index("events_received_event_idx", text("received_at DESC"), text("event_id DESC")),
+        Index(
+            "events_agent_received_event_idx",
+            "agent_id",
+            text("received_at DESC"),
+            text("event_id DESC"),
+        ),
+        Index(
+            "events_check_received_event_idx",
+            "check_id",
+            text("received_at DESC"),
+            text("event_id DESC"),
+        ),
     )
 
 
@@ -144,6 +204,25 @@ class Incident(Base):
     resolved_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     summary: Mapped[str | None] = mapped_column(Text, nullable=True)
     last_event_id: Mapped[UUID] = mapped_column(_uuid(), nullable=False)
+    # PH-review: stored generated column so the default UI sort
+    # (status_rank, opened_at, id) is served by a plain B-tree index without
+    # planner mismatches between query-time and index-time CASE expressions.
+    # Keep aligned with `_STATUS_RANK` in api/incidents.py.
+    status_rank: Mapped[int] = mapped_column(
+        Integer,
+        Computed(
+            "CASE "
+            "WHEN state = 'open' AND severity = 'critical' THEN 5 "
+            "WHEN state = 'open' AND severity = 'warning' THEN 4 "
+            "WHEN state = 'open' AND severity = 'unknown' THEN 3 "
+            "WHEN state = 'resolved' AND severity = 'critical' THEN 2 "
+            "WHEN state = 'resolved' AND severity = 'warning' THEN 1 "
+            "WHEN state = 'resolved' AND severity = 'unknown' THEN 0 "
+            "END",
+            persisted=True,
+        ),
+        nullable=False,
+    )
 
     __table_args__ = (
         CheckConstraint("state IN ('open','resolved')", name="incidents_state_chk"),
@@ -156,7 +235,12 @@ class Incident(Base):
             unique=True,
             postgresql_where=text("state = 'open'"),
         ),
-        Index("incidents_state_opened_idx", "state", text("opened_at DESC")),
+        Index(
+            "incidents_status_rank_idx",
+            text("status_rank DESC"),
+            text("opened_at DESC"),
+            text("id DESC"),
+        ),
     )
 
 
@@ -193,4 +277,6 @@ class NotificationOutbox(Base):
             "next_attempt_at",
             postgresql_where=text("state IN ('pending','retry')"),
         ),
+        Index("outbox_created_at_idx", text("created_at DESC"), text("id DESC")),
+        Index("outbox_updated_at_idx", text("updated_at DESC"), text("id DESC")),
     )