feat(noema-agent): add calendar conflict-check tool

.github/workflows/app-ci.yml

@@ -2,10 +2,6 @@ name: Application CI
 
 on:
   pull_request:
-    branches:
-      - develop
-      - master
-      - "release/**"
   push:
     branches:
       - develop

.github/workflows/bandit.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [ develop, master ]
   pull_request:
-    branches: [ develop, master ]
   workflow_dispatch:
 
 permissions:

.github/workflows/dependency-review.yml

@@ -2,10 +2,6 @@ name: Dependency Review
 
 on:
   pull_request:
-    branches:
-      - develop
-      - master
-      - "release/**"
   workflow_dispatch:
 
 permissions:

.github/workflows/docker-publish.yml

@@ -5,10 +5,6 @@ on:
     tags:
       - "v*"
   pull_request:
-    branches:
-      - develop
-      - master
-      - "release/**"
 
 permissions:
   contents: read

backend/alembic/versions/0001_initial_control_plane.py

@@ -9,7 +9,7 @@
 from sqlalchemy import text
 
 from db.models import Base
-from scripts.bootstrap_db import schema_backfill_sql
+from scripts.bootstrap_db import execute_schema_backfill
 
 revision = "0001_initial_control_plane"
 down_revision = None
@@ -19,8 +19,7 @@ def upgrade() -> None:
     connection = op.get_bind()
     connection.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
     Base.metadata.create_all(connection)
-    for statement in schema_backfill_sql():
-        connection.execute(statement)
+    execute_schema_backfill(connection)
 
 
 def downgrade() -> None:

backend/alembic/versions/0018_calendar_conflict_judgments.py

@@ -0,0 +1,109 @@
+"""add calendar conflict judgments and corrections
+
+Revision ID: 0018_calendar_conflict_judgments
+Revises: 0017_merge_newsdom_carddav_heads
+Create Date: 2026-08-30 00:00:00.000000
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0018_calendar_conflict_judgments"
+down_revision = "0017_merge_newsdom_carddav_heads"
+
+_JUDGMENT_TABLE = "calendar_conflict_judgments"
+_CORRECTION_TABLE = "calendar_conflict_corrections"
+
+
+def upgrade() -> None:
+    connection = op.get_bind()
+    inspector = sa.inspect(connection)
+
+    if not inspector.has_table(_JUDGMENT_TABLE):
+        op.create_table(
+            _JUDGMENT_TABLE,
+            sa.Column("calendar_conflict_judgment_id", sa.Integer(), nullable=False),
+            sa.Column("judgment_uid", sa.String(length=96), nullable=False),
+            sa.Column("user_id", sa.String(), nullable=False),
+            sa.Column("organization_id", sa.String(), nullable=True),
+            sa.Column("workspace_id", sa.String(), nullable=False),
+            sa.Column("proposed_commitment_id", sa.String(length=256), nullable=False),
+            sa.Column("source_thread_id", sa.String(), nullable=True),
+            sa.Column("source_message_id", sa.String(), nullable=True),
+            sa.Column("decision_code", sa.String(length=32), nullable=False),
+            sa.Column("reason_code", sa.String(length=64), nullable=False),
+            sa.Column("recommended_action", sa.Text(), nullable=False),
+            sa.Column("policy_version", sa.String(length=32), nullable=False),
+            sa.Column("conflicts_json", sa.JSON(), nullable=False),
+            sa.Column("status_code", sa.String(length=32), nullable=False),
+            sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+            sa.PrimaryKeyConstraint("calendar_conflict_judgment_id"),
+            sa.UniqueConstraint(
+                "judgment_uid", name="uq_calendar_conflict_judgments_uid"
+            ),
+        )
+
+    if not inspector.has_table(_CORRECTION_TABLE):
+        op.create_table(
+            _CORRECTION_TABLE,
+            sa.Column("calendar_conflict_correction_id", sa.Integer(), nullable=False),
+            sa.Column("correction_uid", sa.String(length=96), nullable=False),
+            sa.Column("calendar_conflict_judgment_id", sa.Integer(), nullable=False),
+            sa.Column("user_id", sa.String(), nullable=False),
+            sa.Column("organization_id", sa.String(), nullable=True),
+            sa.Column("workspace_id", sa.String(), nullable=False),
+            sa.Column("actor_user_id", sa.String(), nullable=False),
+            sa.Column("correction_action", sa.String(length=64), nullable=False),
+            sa.Column("before_json", sa.JSON(), nullable=False),
+            sa.Column("after_json", sa.JSON(), nullable=False),
+            sa.Column("rationale", sa.Text(), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+            sa.ForeignKeyConstraint(
+                ["calendar_conflict_judgment_id"],
+                ["calendar_conflict_judgments.calendar_conflict_judgment_id"],
+            ),
+            sa.PrimaryKeyConstraint("calendar_conflict_correction_id"),
+            sa.UniqueConstraint(
+                "correction_uid", name="uq_calendar_conflict_corrections_uid"
+            ),
+        )
+
+    for table_name, indexes in _calendar_conflict_indexes().items():
+        for index_name, column_names in indexes:
+            op.create_index(
+                index_name,
+                table_name,
+                column_names,
+                if_not_exists=True,
+            )
+
+
+def downgrade() -> None:
+    connection = op.get_bind()
+    inspector = sa.inspect(connection)
+
+    for table_name in (_CORRECTION_TABLE, _JUDGMENT_TABLE):
+        if inspector.has_table(table_name):
+            for index_name, _column_names in reversed(
+                _calendar_conflict_indexes()[table_name]
+            ):
+                op.drop_index(index_name, table_name=table_name, if_exists=True)
+            op.drop_table(table_name)
+
+
+def _calendar_conflict_indexes() -> dict[str, list[tuple[str, list[str]]]]:
+    return {
+        _JUDGMENT_TABLE: [
+            (
+                "ix_calendar_conflict_judgments_scope_thread",
+                ["user_id", "organization_id", "workspace_id", "source_thread_id"],
+            ),
+        ],
+        _CORRECTION_TABLE: [
+            (
+                "ix_calendar_conflict_corrections_judgment",
+                ["calendar_conflict_judgment_id"],
+            ),
+        ],
+    }

backend/alembic/versions/0019_attachment_uid.py

@@ -0,0 +1,97 @@
+"""add attachment_uid opaque id to email_attachments
+
+Revision ID: 0019_attachment_uid
+Revises: 0018_calendar_conflict_judgments
+Create Date: 2026-08-30 00:00:00.000000
+"""
+
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0019_attachment_uid"
+down_revision = "0018_calendar_conflict_judgments"
+
+_ATTACHMENT_TABLE = "email_attachments"
+_ATTACHMENT_UID_INDEX = "uq_email_attachments_uid"
+
+
+def _attachment_table_stub() -> sa.TableClause:
+    return sa.table(
+        _ATTACHMENT_TABLE,
+        sa.column("id", sa.Integer()),
+        sa.column("attachment_uid", sa.String()),
+    )
+
+
+def upgrade() -> None:
+    connection = op.get_bind()
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(_ATTACHMENT_TABLE):
+        return
+
+    existing_columns = {
+        column["name"] for column in inspector.get_columns(_ATTACHMENT_TABLE)
+    }
+    if "attachment_uid" not in existing_columns:
+        op.add_column(
+            _ATTACHMENT_TABLE,
+            sa.Column("attachment_uid", sa.String(length=96), nullable=True),
+        )
+        attachments = _attachment_table_stub()
+        rows = connection.execute(
+            sa.select(attachments.c.id).where(attachments.c.attachment_uid.is_(None))
+        ).fetchall()
+        for (attachment_id,) in rows:
+            connection.execute(
+                sa.update(attachments)
+                .where(attachments.c.id == attachment_id)
+                .values(attachment_uid=f"attachment_{uuid.uuid4().hex}")
+            )
+        op.alter_column(_ATTACHMENT_TABLE, "attachment_uid", nullable=False)
+
+    existing_indexes = {
+        index["name"] for index in inspector.get_indexes(_ATTACHMENT_TABLE)
+    }
+    if _ATTACHMENT_UID_INDEX not in existing_indexes:
+        op.create_index(
+            _ATTACHMENT_UID_INDEX,
+            _ATTACHMENT_TABLE,
+            ["attachment_uid"],
+            unique=True,
+            if_not_exists=True,
+        )
+
+
+def downgrade() -> None:
+    connection = op.get_bind()
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(_ATTACHMENT_TABLE):
+        return
+
+    # A database built by alembic upgrade carries _ATTACHMENT_UID_INDEX as a
+    # plain unique index (this file's own upgrade() uses op.create_index), but
+    # one bootstrapped fresh via Base.metadata.create_all() (db/models.py's
+    # Attachment declares the same name as a table-level UniqueConstraint)
+    # carries a constraint-owned index of the identical name instead --
+    # PostgreSQL rejects a bare DROP INDEX on that shape ("cannot drop index
+    # ... because constraint ... requires it"), so the two shapes need
+    # different drop statements rather than one op.drop_index() for both.
+    unique_constraint_names = {
+        constraint["name"]
+        for constraint in inspector.get_unique_constraints(_ATTACHMENT_TABLE)
+    }
+    if _ATTACHMENT_UID_INDEX in unique_constraint_names:
+        op.drop_constraint(
+            _ATTACHMENT_UID_INDEX, _ATTACHMENT_TABLE, type_="unique"
+        )
+    else:
+        op.drop_index(
+            _ATTACHMENT_UID_INDEX, table_name=_ATTACHMENT_TABLE, if_exists=True
+        )
+    existing_columns = {
+        column["name"] for column in inspector.get_columns(_ATTACHMENT_TABLE)
+    }
+    if "attachment_uid" in existing_columns:
+        op.drop_column(_ATTACHMENT_TABLE, "attachment_uid")