mig: add upstream identity and validation columns to remote_sessions

[daviddanialy]

AIM-203, part 1 of 2. Stacked on #6090; merge that first. Supersedes #6099, which GitHub closed when its base branch was folded into #6090.

Summary

• Adds thirteen nullable columns to remote_sessions, all with no default:
  • identity: upstream_subject, upstream_email, upstream_email_verified, upstream_display_name, upstream_picture_url, upstream_session_id, upstream_auth_time, identity_source, identity_verified_at, enrichment jsonb
  • validity: last_validated_at, validation_status, validation_reason
• Schema, Atlas migration, and regenerated sqlc models only. Nothing writes the columns yet; the ID-token and token-response enrichers (part 2) and the validate action (AIM-204) start populating them.
• identity_source and validation_status are plain text with values validated in application code, following the repo rule of not using CHECK constraints for enumerations. NULL on both means no interface has reported yet.

Motivation

A remote session stores tokens and deadlines only, so the consent page cannot say who an upstream grant belongs to or whether the token still works. It infers "Connected" from timestamps, which is wrong for revoked tokens and meaningless for the 15% of prod sessions whose provider issues non-expiring tokens without a refresh token. These columns hold what the enrichment interfaces return, normalised into one typed projection with a verbatim JSON column for the rest, and the last observed validity of the token. upstream_email is the first third-party email Gram persists; it is stored in plaintext like every other email column and is cleared with the session.

Plain ADD COLUMN ... NULL, no rewrite or scan.

No index ships with these columns on purpose. Every value is NULL until the writers land, so an index now is maintenance cost on a hot table with nothing to shape a plan, and the two lookups that will want one (push revocation by issuer, client, and subject; the validation sweep by status) cannot have their column order and partial predicate chosen until those queries exist. Atlas emits CREATE INDEX CONCURRENTLY, so adding it later against populated rows is online. The query PR owes the index.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C555wgLmfbVWf4oxK7FvwB

---

Summary by cubic

Part 1 of AIM-203 adds nullable upstream identity and validation columns to remote_sessions, which currently stores only tokens and deadlines, so the consent page can later show who an upstream grant belongs to and whether its token still works. This PR is schema, Atlas migration, changeset, and regenerated sqlc models only; nothing writes the columns yet.

• All thirteen columns are nullable with no default; NULL means no enrichment interface has reported yet.
• enrichment stores the unmodeled remainder of an enrichment response as JSONB.
• upstream_email is stored in plaintext like existing email columns and cleared with the session.
• Uses plain text for identity_source and validation_status, with values validated in application code.
• Plain ADD COLUMN ... NULL; no index ships yet because every value is NULL until the writers land.

^{Written for commit dc45ad5. Summary will update on new commits.}

[linear-code]

AIM-203

[changeset-bot]

🦋 Changeset detected

Latest commit: dc45ad5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

atlas migrate lint on server/migrations

Status	Step	Result
	2 new migration files detected	20260904232947_remote-session-issuers-enrichment-and-metadata-fetch.sql 20260904233232_remote-sessions-upstream-identity-and-validation.sql
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[github-actions]

atlas migrate lint on server/clickhouse/migrations

Status	Step	Result
	No migration files detected
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[cubic-dev-ai]

1 issue found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="server/database/schema.sql">

<violation number="1" location="server/database/schema.sql:2581">
P1: Custom agent: **Flag Security Vulnerabilities**

Soft-deleted sessions retain the new upstream identity and personal data. `remote_sessions` uses `deleted_at` rather than physical deletion, and this schema adds no trigger or deletion rule to clear `upstream_email`, the other identity fields, or `enrichment`; clear these fields in every session-revocation path (including client/issuer cascades) or enforce clearing at the database layer.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>