chore: simplify hackathon production release

.github/workflows/agent-layer-release.yml

@@ -1,34 +1,6 @@
 name: Agent Layer Release
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/**"
-      - "apps/api/**"
-      - "apps/intelligence-worker/**"
-      - "apps/wechat-ilink-worker/**"
-      - "packages/agent-core/**"
-      - "packages/intelligence/**"
-      - "packages/user-model/**"
-      - "packages/matchmaking/**"
-      - "packages/feedback/**"
-      - "packages/contracts/**"
-      - "packages/data/**"
-      - "packages/game-catalog/**"
-      - "packages/room/**"
-      - "packages/wechat-ilink/**"
-      - "supabase/migrations/**"
-      - "scripts/**"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "tsconfig.base.json"
-      - "eslint.config.mjs"
-      - "railway.api.toml"
-      - "railway.worker.toml"
-      - "railway.wechat.toml"
   workflow_dispatch:
     inputs:
       release_ref:

.github/workflows/production-watch.yml

@@ -1,8 +1,6 @@
 name: Production Watch
 
 on:
-  schedule:
-    - cron: "*/5 * * * *"
   workflow_dispatch:
 
 concurrency:

packages/data/src/migration.test.ts

@@ -1125,6 +1125,57 @@ describe("Supabase migration", () => {
     });
   });
 
+  it("grants lease-aware LLM job RPCs only to the service role", async () => {
+    const privileges = await db.query<{
+      anon_heartbeat: boolean;
+      authenticated_complete: boolean;
+      authenticated_fail: boolean;
+      service_heartbeat: boolean;
+      service_complete: boolean;
+      service_fail: boolean;
+    }>(`
+      select
+        has_function_privilege(
+          'anon',
+          'public.heartbeat_llm_job(uuid,text)',
+          'execute'
+        ) as anon_heartbeat,
+        has_function_privilege(
+          'authenticated',
+          'public.complete_llm_job(uuid,jsonb,text)',
+          'execute'
+        ) as authenticated_complete,
+        has_function_privilege(
+          'authenticated',
+          'public.fail_llm_job(uuid,text,text)',
+          'execute'
+        ) as authenticated_fail,
+        has_function_privilege(
+          'service_role',
+          'public.heartbeat_llm_job(uuid,text)',
+          'execute'
+        ) as service_heartbeat,
+        has_function_privilege(
+          'service_role',
+          'public.complete_llm_job(uuid,jsonb,text)',
+          'execute'
+        ) as service_complete,
+        has_function_privilege(
+          'service_role',
+          'public.fail_llm_job(uuid,text,text)',
+          'execute'
+        ) as service_fail
+    `);
+    expect(privileges.rows[0]).toEqual({
+      anon_heartbeat: false,
+      authenticated_complete: false,
+      authenticated_fail: false,
+      service_heartbeat: true,
+      service_complete: true,
+      service_fail: true
+    });
+  });
+
   it("keeps dynamic matchmaking state and RPCs service-role only", async () => {
     const privileges = await db.query<{
       rls_enabled: boolean;

scripts/workflow-syntax.test.mjs

@@ -32,12 +32,16 @@ test("GitHub Actions workflows are valid YAML with triggers and jobs", async ()
       assert.doesNotMatch(source, /\bpush:/u);
     }
     if (file === "agent-layer-release.yml") {
-      assert.match(source, /branches:\s*\n\s+- main/u);
-      assert.doesNotMatch(source, /branches:\s*\n\s+- feat\/wechat-channel/u);
+      assert.deepEqual(Object.keys(workflow.on), ["workflow_dispatch"]);
+      assert.doesNotMatch(source, /^\s*push:/mu);
       assert.doesNotMatch(source, /agent:release:verify/u);
       assert.match(source, /current-release/u);
       assert.match(source, /SMOKE_FRONTEND_ORIGIN/u);
       assert.match(source, /pnpm wechat:smoke:qr/u);
     }
+    if (file === "production-watch.yml") {
+      assert.deepEqual(Object.keys(workflow.on), ["workflow_dispatch"]);
+      assert.doesNotMatch(source, /^\s*schedule:/mu);
+    }
   }
 });

supabase/migrations/20260726000000_grant_llm_job_lease_rpc.sql

@@ -0,0 +1,4 @@
+-- Restore worker access after the lease-aware RPC signatures were replaced.
+grant execute on function public.heartbeat_llm_job(uuid, text) to service_role;
+grant execute on function public.complete_llm_job(uuid, jsonb, text) to service_role;
+grant execute on function public.fail_llm_job(uuid, text, text) to service_role;