feat(dgw): record provisioner tasks in gateway.db

A Task is the permanent record of work the provisioner asked Gateway
to do: its kind, target and parameters, its state and a payload the
kind defines. The work itself will run as a job on the job queue,
which forgets it once done; the Task stays for status and auditing.

The provisioner chooses the Task ID, so asking again with the same
request returns the existing Task. At most one unfinished Task works
on a target per kind, and a Task past its deadline is failed when
another one asks for its target, so a lost job never blocks it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: irvingoujAtDevolution

Cargo.lock

@@ -14,10 +14,14 @@ anyhow = "1"
 async-trait = "0.1"
 camino = "1.1"
 libsql = { version = "0.9", default-features = false, features = ["core", "serde"] }
+provisioner-task.path = "../provisioner-task"
+serde_json = "1"
+time = { version = "0.3", default-features = false }
 tokio = { version = "1.52", features = ["sync"] }
 tracing = "0.1"
 uuid = "1.23"
 
 [dev-dependencies]
 tempfile = "3.24"
 tokio = { version = "1.52", features = ["macros", "rt-multi-thread"] }
+uuid = { version = "1.23", features = ["v4"] }

crates/gateway-db/Cargo.toml

@@ -0,0 +1,20 @@
+CREATE TABLE provisioner_task (
+    id TEXT PRIMARY KEY,
+    kind TEXT NOT NULL,
+    target TEXT NOT NULL,
+    params TEXT NOT NULL,
+    state TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    started_at INTEGER,
+    finished_at INTEGER,
+    deadline_at INTEGER NOT NULL,
+    CHECK (state IN ('queued', 'running', 'succeeded', 'failed')),
+    CHECK ((state IN ('succeeded', 'failed')) = (finished_at IS NOT NULL)),
+    CHECK (json_valid(params) AND json_valid(payload)),
+    CHECK (attempts >= 0)
+);
+
+CREATE UNIQUE INDEX provisioner_task_unfinished ON provisioner_task (kind, target)
+    WHERE state IN ('queued', 'running');

crates/gateway-db/migrations/03_provisioner_task.sql

@@ -9,6 +9,7 @@
 extern crate tracing;
 
 pub mod agent_tunnel;
+pub mod provisioner_task;
 
 use anyhow::{Context as _, bail};
 use camino::{Utf8Path, Utf8PathBuf};
@@ -31,6 +32,7 @@ const PRAGMAS: &str = "
 const MIGRATIONS: &[&str] = &[
     include_str!("../migrations/01_agent_tunnel.sql"),
     include_str!("../migrations/02_prefix_agent_tunnel_tables.sql"),
+    include_str!("../migrations/03_provisioner_task.sql"),
 ];
 
 /// The open `gateway.db`, ready to hand a connection to each feature that keeps tables in it.
@@ -250,6 +252,7 @@ mod tests {
         assert!(table_exists(&conn, "agent_tunnel_accepted_agents").await);
         assert!(table_exists(&conn, "agent_tunnel_enrollment_attempts").await);
         assert!(table_exists(&conn, "agent_tunnel_deleted_agent_keys").await);
+        assert!(table_exists(&conn, "provisioner_task").await);
         assert!(!table_exists(&conn, "metadata").await);
     }