Add a secure repository Prompts review surface and prompt metadata API

Hop-State: A_06FN6MRSHG4B64ZV13086G8
Hop-Proposal: R_06FN6MQDE14FFNR65H1D28G
Hop-Task: T_06FN6J8ECE1Z9XQ5PQ3Z3D8
Hop-Attempt: AT_06FN6J8ECC1SC794JMZ0TF8

services/control-plane/internal/store/migrations/002_prompts.sql

@@ -0,0 +1,17 @@
+CREATE TABLE prompts (
+    id text PRIMARY KEY,
+    repository_id text NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
+    task_id text NOT NULL DEFAULT '',
+    attempt_id text NOT NULL DEFAULT '',
+    state_id text NOT NULL DEFAULT '',
+    prompt text NOT NULL,
+    agent_name text NOT NULL DEFAULT '',
+    agent_model text NOT NULL DEFAULT '',
+    status text NOT NULL DEFAULT 'running' CHECK (status IN ('running', 'completed', 'failed', 'cancelled')),
+    response_summary text NOT NULL DEFAULT '',
+    metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    completed_at timestamptz
+);
+
+CREATE INDEX prompts_repository_created_at_idx ON prompts (repository_id, created_at DESC);

services/control-plane/internal/store/store.go

@@ -3,6 +3,7 @@ package store
 import (
 	"context"
 	"embed"
+	"encoding/json"
 	"fmt"
 	"sort"
 	"time"
@@ -37,10 +38,42 @@ type WebhookDelivery struct {
 	Repository    *gitea.Repository
 }
 
+type Prompt struct {
+	ID              string          `json:"id"`
+	TaskID          string          `json:"task_id,omitempty"`
+	AttemptID       string          `json:"attempt_id,omitempty"`
+	StateID         string          `json:"state_id,omitempty"`
+	Prompt          string          `json:"prompt"`
+	AgentName       string          `json:"agent_name,omitempty"`
+	AgentModel      string          `json:"agent_model,omitempty"`
+	Status          string          `json:"status"`
+	ResponseSummary string          `json:"response_summary,omitempty"`
+	Metadata        json.RawMessage `json:"metadata"`
+	CreatedAt       time.Time       `json:"created_at"`
+	CompletedAt     *time.Time      `json:"completed_at,omitempty"`
+}
+
+type CreatePromptInput struct {
+	Owner           string
+	Repository      string
+	TaskID          string
+	AttemptID       string
+	StateID         string
+	Prompt          string
+	AgentName       string
+	AgentModel      string
+	Status          string
+	ResponseSummary string
+	Metadata        json.RawMessage
+	CompletedAt     *time.Time
+}
+
 type Store interface {
 	Ping(context.Context) error
 	ListRepositories(context.Context) ([]Repository, error)
 	UpsertRepository(context.Context, gitea.Repository) (Repository, error)
+	ListPrompts(context.Context, string, string, int) ([]Prompt, error)
+	CreatePrompt(context.Context, CreatePromptInput) (Prompt, error)
 	RecordWebhook(context.Context, WebhookDelivery) (bool, error)
 }
 
@@ -129,6 +162,53 @@ func (p *Postgres) UpsertRepository(ctx context.Context, repository gitea.Reposi
 	return upsertRepository(ctx, p.pool, id, repository)
 }
 
+func (p *Postgres) ListPrompts(ctx context.Context, owner, name string, limit int) ([]Prompt, error) {
+	rows, err := p.pool.Query(ctx, `
+		SELECT p.id, p.task_id, p.attempt_id, p.state_id, p.prompt, p.agent_name, p.agent_model,
+			p.status, p.response_summary, p.metadata, p.created_at, p.completed_at
+		FROM prompts p
+		JOIN repositories r ON r.id = p.repository_id
+		WHERE r.owner=$1 AND r.name=$2
+		ORDER BY p.created_at DESC
+		LIMIT $3`, owner, name, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	prompts := make([]Prompt, 0)
+	for rows.Next() {
+		var prompt Prompt
+		if err := rows.Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt); err != nil {
+			return nil, err
+		}
+		prompts = append(prompts, prompt)
+	}
+	return prompts, rows.Err()
+}
+
+func (p *Postgres) CreatePrompt(ctx context.Context, input CreatePromptInput) (Prompt, error) {
+	id, err := ids.Prompt()
+	if err != nil {
+		return Prompt{}, err
+	}
+	metadata := input.Metadata
+	if len(metadata) == 0 {
+		metadata = json.RawMessage(`{}`)
+	}
+	var prompt Prompt
+	err = p.pool.QueryRow(ctx, `
+		INSERT INTO prompts (id, repository_id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, completed_at)
+		SELECT $1, r.id, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13
+		FROM repositories r WHERE r.owner=$2 AND r.name=$3
+		RETURNING id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, created_at, completed_at`,
+		id, input.Owner, input.Repository, input.TaskID, input.AttemptID, input.StateID, input.Prompt, input.AgentName, input.AgentModel, input.Status, input.ResponseSummary, metadata, input.CompletedAt,
+	).Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt)
+	if err != nil {
+		return Prompt{}, err
+	}
+	return prompt, nil
+}
+
 type querier interface {
 	QueryRow(context.Context, string, ...any) pgx.Row
 }