decision

type ListParams struct {
	// ProjectID, if set, restricts results to this project. Mutually
	// exclusive with RepoName — callers (or the MCP handler) must pick one.
	ProjectID *uuid.UUID
	// RepoName, if non-empty, restricts results to this repo.
	RepoName string
	// IncludeAuto, when false (the default), restricts results to
	// Source=manual only. When true, both manual and auto decisions are
	// returned. Fail-closed: zero value is false.
	IncludeAuto bool
	// Limit MUST be in 1..100. Callers normalize (default 20, cap 100)
	// before calling List; List itself enforces the range via Validate.
	Limit int32
}

type LogParams struct {
	ProjectID *uuid.UUID
	// TaskID links this decision to a specific task (migration 000048).
	// No FK constraint (CLAUDE.md red-line §9); referential integrity in code.
	TaskID       *uuid.UUID
	RepoName     string
	Title        string
	Context      string
	Decision     string
	Rationale    string
	Alternatives string
	// Source is required and MUST be set by the calling code path
	// (SourceManual or SourceAuto), never decoded from a caller payload.
	Source Source
	// ActorSessionID identifies which MCP client session wrote this
	// decision (migration 000076). Empty string means "unknown/not
	// recorded" (stored as SQL NULL — see pgconv.ToText). It MUST be set by
	// the calling code path from its own session context, never decoded
	// from a caller-supplied payload (backend-security-design.md §2
	// adversarial input / provenance integrity). Populated by every
	// internal/mcp write path via Server.auditSessionID (U15,
	// tools_gtd.go) — that helper falls back to the server's per-process
	// session ID rather than "" when ctx carries no tracked MCP client
	// session, so this column should be non-empty on every row written
	// through the MCP server.
	ActorSessionID string
	// ConfirmedByHuman records whether a human explicitly confirmed this
	// decision (migration 000076). false is the honest default meaning "not
	// proven to be human" — it is NOT proof the decision was
	// machine-written; Source already carries the manual/auto distinction
	// and manual does NOT imply human-confirmed (see Source's doc comment
	// above). It MUST be set by the calling code path via an actual
	// confirmation gate, never decoded from a caller-supplied payload
	// (backend-security-design.md §2) — that confirmation gate does not
	// exist yet in this contract layer (U15); this field currently always
	// writes false.
	ConfirmedByHuman bool
}

type Source string

type Store struct {
	// contains filtered or unexported fields
}

type StoreIface interface {
	Log(ctx context.Context, p LogParams) (*db.Decision, error)
	ByRepo(ctx context.Context, repoName string, limit int32) ([]db.Decision, error)
	All(ctx context.Context, limit int32) ([]db.Decision, error)
	ByProject(ctx context.Context, projectID uuid.UUID, limit int32) ([]db.Decision, error)
	// ByTask returns the most recent decisions linked to a specific task UUID.
	// SECURITY: scoped to workspace_id.
	ByTask(ctx context.Context, taskID uuid.UUID, limit int32) ([]db.Decision, error)
	// SearchByCosine returns the top-limit decisions most similar to queryEmbedding.
	// SECURITY: scoped to workspace_id.
	SearchByCosine(ctx context.Context, queryEmbedding []float32, limit int) ([]db.Decision, error)
	// List returns decisions filtered by ListParams (project XOR repo, plus
	// IncludeAuto). Workspace is NOT a ListParams field — it stays
	// store-scoped. See ListParams.Validate for the rejected combinations.
	List(ctx context.Context, p ListParams) ([]db.Decision, error)
}