fix(server): scope observations to their workspace

Author: FelixTJDietrich

.changeset/quiet-dragons-observe.md

@@ -0,0 +1,5 @@
+---
+"@ls1intum/hephaestus": patch
+---
+
+Keeps historical practice observations attributable to the exact criteria that produced them and enforces workspace isolation directly on every observation.

docs/contributor/erd/schema.mmd

@@ -780,9 +780,10 @@ erDiagram
         TEXT evidence_rationale
         TIMESTAMPTZ observed_at "NOT NULL"
         VARCHAR(64) recurrence_key
-        BIGINT practice_revision_id FK
+        BIGINT practice_revision_id FK "NOT NULL"
         VARCHAR(8) assessment
         VARCHAR(16) origin "NOT NULL"
+        BIGINT workspace_id FK "NOT NULL"
     }
 
     Organization {
@@ -865,7 +866,7 @@ erDiagram
     }
 
     Practice {
-        BIGINT id PK
+        BIGINT id PK,UK
         BIGINT workspace_id FK,UK "NOT NULL"
         VARCHAR(64) slug UK "NOT NULL"
         VARCHAR(128) name "NOT NULL"
@@ -1572,6 +1573,7 @@ erDiagram
     User ||--o{ Milestone : created_by
     Practice ||--o{ Observation : has
     PracticeRevision ||--o{ Observation : has
+    Workspace ||--o{ Observation : has
     AgentJob ||--o{ Observation : has
     User ||--o{ Observation : has
     IdentityProvider ||--o{ Organization : references

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/FeedbackLedgerRecorder.java

@@ -189,7 +189,10 @@ private void record(
         if (!summaryDelivered && !inlineDelivered) {
             return;
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return;
         }
@@ -437,7 +440,10 @@ private void recordSuppressedUnitInCurrentTransaction(
         if (feedbackRepository.existsByAgentJobIdAndPosition(job.getId(), GATE_SUPPRESSED_UNIT_ORDINAL)) {
             return; // already recorded (job retry)
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return;
         }
@@ -457,7 +463,10 @@ public void recordSuppressedRemainder(
         if (feedbackRepository.existsByAgentJobIdAndPosition(job.getId(), GATE_SUPPRESSED_UNIT_ORDINAL)) {
             return;
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return;
         }
@@ -526,7 +535,10 @@ public void recordRecoveredSummary(AgentJob job, String externalRef, String body
         if (feedbackRepository.existsByAgentJobIdAndPosition(job.getId(), IN_CONTEXT_UNIT_ORDINAL)) {
             return;
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return;
         }
@@ -575,7 +587,10 @@ public void recordRecoveredSummary(AgentJob job, String externalRef, String body
 
     @Transactional(propagation = Propagation.REQUIRES_NEW, readOnly = true)
     public Optional<String> priorLiveIssueSummaryRef(AgentJob job) {
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return Optional.empty();
         }
@@ -625,7 +640,7 @@ public void recordProposal(AgentJob job, @Nullable DeliveryContent delivery, Lis
         if (body.isBlank()) return;
         if (feedbackRepository.existsByAgentJobIdAndPosition(job.getId(), position)) return;
         Map<String, Observation> stored = observationRepository
-            .findByAgentJobId(job.getId())
+            .findByAgentJobId(job.getId(), job.getWorkspace().getId())
             .stream()
             .filter(observation -> observation.getOccurrenceKey() != null)
             .collect(
@@ -755,7 +770,10 @@ public void recordUndelivered(AgentJob job, @Nullable DeliveryContent delivery)
         if (feedbackRepository.existsByAgentJobIdAndPosition(job.getId(), UNDELIVERED_UNIT_ORDINAL)) {
             return; // already recorded (job retry)
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> observations = observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        );
         if (observations.isEmpty()) {
             return;
         }

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/InContextDeliveryGate.java

@@ -163,7 +163,10 @@ public List<ValidatedObservation> awaitingApproval(AgentJob job, List<ValidatedO
 
     private void recordWithheld(AgentJob job, List<ValidatedObservation> withheld, FeedbackSuppressionReason reason) {
         Map<String, Observation> byOccurrence = new HashMap<>();
-        for (Observation observation : observationRepository.findByAgentJobId(job.getId())) {
+        for (Observation observation : observationRepository.findByAgentJobId(
+            job.getId(),
+            job.getWorkspace().getId()
+        )) {
             byOccurrence.put(observation.getOccurrenceKey(), observation);
         }
         int index = 0;

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/IssueReviewHandler.java

@@ -254,7 +254,7 @@ private String buildPrompt(int issueNumber, String repoName, AgentJob job) {
     public void deliver(AgentJob job) {
         ObservationAdmissionService.requireMatchingCompositionDigest(job);
         List<PracticeDetectionResultParser.ValidatedObservation> observations = observationRepository
-            .findByAgentJobId(job.getId())
+            .findByAgentJobId(job.getId(), job.getWorkspace().getId())
             .stream()
             .map(this::validated)
             .toList();

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/ObservationAdmissionService.java

@@ -62,7 +62,7 @@ public ObjectNode admit(UUID jobId, JsonNode submitted) {
         String existing = currentMetadata == null ? "" : currentMetadata.path(DIGEST_METADATA_KEY).asString();
         if (!existing.isBlank()) {
             if (!existing.equals(digest)) throw new AdmissionConflictException();
-            return response(job, existing, observations.findByAgentJobId(jobId));
+            return response(job, existing, observations.findByAgentJobId(jobId, job.getWorkspace().getId()));
         }
         switch (job.getJobType()) {
             case PULL_REQUEST_REVIEW -> pullRequests.admitObservations(job, submitted);
@@ -74,7 +74,7 @@ public ObjectNode admit(UUID jobId, JsonNode submitted) {
         metadata.put(DIGEST_METADATA_KEY, digest);
         job.setMetadata(metadata);
         jobs.save(job);
-        return response(job, digest, observations.findByAgentJobId(jobId));
+        return response(job, digest, observations.findByAgentJobId(jobId, job.getWorkspace().getId()));
     }
 
     private byte[] serializedPayload(JsonNode submitted) {

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/PracticeDetectionDeliveryService.java

@@ -275,6 +275,7 @@ public DeliveryResult deliver(AgentJob job, List<ValidatedObservation> validObse
                 UUID.randomUUID(),
                 occurrenceKey,
                 job.getId(),
+                job.getWorkspace().getId(),
                 practice.getId(),
                 practiceRevisionId,
                 artifactKind.value(),

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/PullRequestReviewHandler.java

@@ -319,7 +319,7 @@ public void deliver(AgentJob job) {
 
     private void deliverAdmitted(AgentJob job) {
         List<PracticeDetectionResultParser.ValidatedObservation> scopedObservations = observationRepository
-            .findByAgentJobId(job.getId())
+            .findByAgentJobId(job.getId(), job.getWorkspace().getId())
             .stream()
             .map(this::validated)
             .toList();

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/ReactionSuppressionFilter.java

@@ -72,7 +72,7 @@ public ReactionDecision evaluate(AgentJob job, List<ValidatedObservation> scoped
         if (!reviewProperties.reactionSuppression()) {
             return new ReactionDecision(scopedObservations, 0);
         }
-        List<Observation> persisted = observationRepository.findByAgentJobId(job.getId());
+        List<Observation> persisted = observationRepository.findByAgentJobId(job.getId(), job.getWorkspace().getId());
         if (persisted.isEmpty()) {
             return new ReactionDecision(scopedObservations, 0);
         }

server/src/main/java/de/tum/cit/aet/hephaestus/agent/handler/conversation/ConversationalDeliveryListener.java

@@ -114,7 +114,7 @@ private int route(UUID agentJobId, UUID outputJobId, Long workspaceId) {
         if (sourceJob == null || !deliveryPolicy.allowsComposition(sourceJob, DeliveryPolicySurface.CONVERSATION)) {
             return 0;
         }
-        List<Observation> observations = observationRepository.findByAgentJobId(agentJobId);
+        List<Observation> observations = observationRepository.findByAgentJobId(agentJobId, workspaceId);
         if (observations.isEmpty()) {
             return 0;
         }