defmodule VavPipeline.Repo.Migrations.CreateBedikot do
  @moduledoc """
  L3 — Bedikot: examinations of external model output. Append-only.

  Construction §3.9. An external model's output is brought to the
  mishkan to be examined against the specification; the verdict and
  its reasons are oral tradition — what the system found when it
  looked, kept so that the same output asked about twice is answered
  from the same reading, and so that the examinations themselves can
  be examined.

  WHAT IS NOT IN THIS TABLE: the raw output. The korban is examined,
  not kept — the record holds its SHA-256 and length, the vital
  content zerikah extracted, the propositions, what each check found,
  the coupling trace, the violations and the verdict. The disposal
  channel's discipline (azazel_records, property 10) is the same:
  the record of the examination, not the thing examined.

  Append-only enforcement matches interpretations: REVOKE UPDATE/DELETE
  on the shorashim_app role.
  """

  use Ecto.Migration

  def up do
    create table(:bedikot) do
      add :bedikah_ref, :text, null: false
      add :provenance, :text, null: false         # which model (claude, gpt, ...)
      add :query, :text                           # what the model was asked, if given
      add :output_sha256, :text, null: false
      add :output_length, :integer, null: false
      add :vital_content, :text, null: false
      add :propositions, {:array, :text}, null: false, default: []
      add :references, {:array, :text}, null: false, default: []
      add :authority_claims, :jsonb, null: false, default: "[]"
      add :actions, :jsonb, null: false, default: "[]"
      add :coupling_trace, {:array, :text}, null: false, default: []
      add :violations, {:array, :text}, null: false, default: []
      add :verdict, :text, null: false            # tov | lo_tov | empty
      add :examined_at, :utc_datetime, null: false
      timestamps(type: :utc_datetime, updated_at: false)
    end

    create constraint(:bedikot, :verdict_is_one_of_three,
      check: "verdict IN ('tov', 'lo_tov', 'empty')"
    )

    create index(:bedikot, [:bedikah_ref])
    create index(:bedikot, [:output_sha256])
    create index(:bedikot, [:examined_at])

    execute """
    DO $$
    BEGIN
      IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'shorashim_app') THEN
        REVOKE UPDATE, DELETE ON bedikot FROM shorashim_app;
      END IF;
    END
    $$;
    """
  end

  def down do
    drop table(:bedikot)
  end
end