Complete training workflow and acceptance hardening

backend/app/db/migrations/versions/a8b5c2d9e1f4_student_scenario_submissions.py

@@ -0,0 +1,55 @@
+"""student-authored scenario proposals with instructor moderation
+
+Revision ID: a8b5c2d9e1f4
+Revises: f7a3c9d1e2b4
+Create Date: 2026-09-24
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "a8b5c2d9e1f4"
+down_revision = "f7a3c9d1e2b4"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "scenario_submissions",
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.Column("author_trainee_id", sa.Uuid(), nullable=False),
+        sa.Column("group_id", sa.Uuid(), nullable=True),
+        sa.Column("title", sa.String(length=200), nullable=False),
+        sa.Column("incident_type", sa.String(length=20), nullable=False),
+        sa.Column("level", sa.String(length=4), nullable=False),
+        sa.Column("description", sa.Text(), nullable=False),
+        sa.Column("address", sa.String(length=500), server_default="", nullable=False),
+        sa.Column("victims", sa.Integer(), nullable=True),
+        sa.Column("status", sa.String(length=16), server_default="pending", nullable=False),
+        sa.Column("review_comment", sa.Text(), server_default="", nullable=False),
+        sa.Column("reviewed_by", sa.String(length=80), nullable=True),
+        sa.Column("scenario_id", sa.String(length=80), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("reviewed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.ForeignKeyConstraint(["author_trainee_id"], ["trainees.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["group_id"], ["groups.id"], ondelete="SET NULL"),
+        sa.ForeignKeyConstraint(["scenario_id"], ["scenarios.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        "ix_scenario_submissions_group_status",
+        "scenario_submissions",
+        ["group_id", "status", "created_at"],
+    )
+    op.create_index(
+        "ix_scenario_submissions_author",
+        "scenario_submissions",
+        ["author_trainee_id", "created_at"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_scenario_submissions_author", table_name="scenario_submissions")
+    op.drop_index("ix_scenario_submissions_group_status", table_name="scenario_submissions")
+    op.drop_table("scenario_submissions")

backend/app/db/migrations/versions/b9c6d3e2f1a0_scenario_submission_kio.py

@@ -0,0 +1,26 @@
+"""store the submitted KIO snapshot for instructor review
+
+Revision ID: b9c6d3e2f1a0
+Revises: a8b5c2d9e1f4
+Create Date: 2026-09-24
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision = "b9c6d3e2f1a0"
+down_revision = "a8b5c2d9e1f4"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "scenario_submissions",
+        sa.Column("kio", postgresql.JSONB(astext_type=sa.Text()), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("scenario_submissions", "kio")

backend/app/db/migrations/versions/c2d7e9f4a1b6_directory_accounts.py

@@ -0,0 +1,42 @@
+"""provision and identify local AD/LDAP accounts
+
+Revision ID: c2d7e9f4a1b6
+Revises: b9c6d3e2f1a0
+Create Date: 2026-09-24
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "c2d7e9f4a1b6"
+down_revision = "b9c6d3e2f1a0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column(
+            "auth_provider",
+            sa.String(length=16),
+            server_default="local",
+            nullable=False,
+        ),
+    )
+    op.add_column(
+        "users", sa.Column("directory_subject", sa.String(length=256), nullable=True)
+    )
+    op.create_unique_constraint(
+        "uq_users_directory_subject", "users", ["directory_subject"]
+    )
+    op.create_check_constraint(
+        "ck_users_auth_provider", "users", "auth_provider IN ('local', 'ldap')"
+    )
+
+
+def downgrade() -> None:
+    op.drop_constraint("ck_users_auth_provider", "users", type_="check")
+    op.drop_constraint("uq_users_directory_subject", "users", type_="unique")
+    op.drop_column("users", "directory_subject")
+    op.drop_column("users", "auth_provider")

backend/app/db/migrations/versions/d3a9f6b2c8e1_session_backend_owner.py

@@ -0,0 +1,31 @@
+"""persist backend node ownership for active sessions
+
+Revision ID: d3a9f6b2c8e1
+Revises: c2d7e9f4a1b6
+Create Date: 2026-09-24
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "d3a9f6b2c8e1"
+down_revision = "c2d7e9f4a1b6"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "sessions",
+        sa.Column("backend_node_id", sa.String(length=128), nullable=True),
+    )
+    op.create_index(
+        "ix_sessions_backend_node_active",
+        "sessions",
+        ["backend_node_id", "ended_at"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_sessions_backend_node_active", table_name="sessions")
+    op.drop_column("sessions", "backend_node_id")

backend/app/db/migrations/versions/e4b7c1d2a9f0_manual_grammar_review.py

@@ -0,0 +1,35 @@
+"""require a grammar check after manual scenario edits
+
+Revision ID: e4b7c1d2a9f0
+Revises: d3a9f6b2c8e1
+Create Date: 2026-09-25
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "e4b7c1d2a9f0"
+down_revision = "d3a9f6b2c8e1"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "scenarios",
+        sa.Column(
+            "manual_edit_pending",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+    op.add_column(
+        "scenarios",
+        sa.Column("grammar_check_hash", sa.String(length=64), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("scenarios", "grammar_check_hash")
+    op.drop_column("scenarios", "manual_edit_pending")

backend/app/db/migrations/versions/f5a7d2c9b3e1_backend_session_leases.py

@@ -0,0 +1,35 @@
+"""add expiring backend ownership leases and fencing epochs
+
+Revision ID: f5a7d2c9b3e1
+Revises: e4b7c1d2a9f0
+Create Date: 2026-09-25
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "f5a7d2c9b3e1"
+down_revision = "e4b7c1d2a9f0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "sessions",
+        sa.Column(
+            "backend_fencing_epoch",
+            sa.Integer(),
+            nullable=False,
+            server_default="0",
+        ),
+    )
+    op.add_column(
+        "sessions",
+        sa.Column("backend_lease_until", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("sessions", "backend_lease_until")
+    op.drop_column("sessions", "backend_fencing_epoch")