ateapi: add persistence compat with MySQL/Vitess in addition to Postgres

.github/workflows/pr-workflow.yaml

@@ -53,13 +53,29 @@ jobs:
         go-version-file: 'go.mod'
     # Unconditional: a released migration becoming permanent is exactly what
     # this guards, and that happens on the push to main, not on the PR.
-    - name: Verify immutable PostgreSQL migrations
-      run: hack/verify/postgresql-migrations.sh
+    - name: Verify immutable SQL migrations
+      run: hack/verify/sql-migrations.sh
     # gotestsum wraps go test to emit JUnit; the go test arguments are unchanged.
     - name: unit tests
       run: hack/run-tool.sh gotestsum --junitfile "${ARTIFACTS}/unit.xml"
         --jsonfile "${ARTIFACTS}/unit.json" --format standard-verbose
         -- -race -v ./...
+    # The unit tests above run the store-backed control plane suites on
+    # PostgreSQL; rerun them on MySQL. atemy's own tests already ran above.
+    - name: MySQL control plane tests
+      env:
+        ATE_TEST_STORE_BACKEND: mysql
+      run: hack/run-tool.sh gotestsum --junitfile "${ARTIFACTS}/unit-mysql.xml"
+        --jsonfile "${ARTIFACTS}/unit-mysql.json" --format standard-verbose
+        -- -race -v ./cmd/ateapi/internal/controlapi/... ./cmd/ateapi/internal/workerservice/...
+    # PlanetScale serves MySQL through Vitess, which rejects or rewrites some
+    # statements plain MySQL accepts. The vitess build tag keeps the large
+    # amd64-only vttestserver image out of the default test run.
+    - name: Vitess store tests
+      run: hack/run-tool.sh gotestsum --junitfile "${ARTIFACTS}/unit-vitess.xml"
+        --jsonfile "${ARTIFACTS}/unit-vitess.json" --format standard-verbose
+        -- -race -v -tags vitess -run '^TestVitess$' ./cmd/ateapi/internal/store/atemy/
+        && grep -q '"Action":"pass".*"Test":"TestVitess"' "${ARTIFACTS}/unit-vitess.json"
     # tools/apitool has its own module so we need to run it explicitly.
     # run-tool.sh resolves the repo root itself, so it works from the subdir.
     - name: apitool tests

AGENTS.md

@@ -94,6 +94,7 @@ See the [metric registry](docs/observability.md#the-metric-registry) section of
 3. Run `make verify` locally before requesting a code review to catch common issues like missed copyright headers or formatting drift.
 4. For end-to-end tests involving the actual infrastructure, ensure you have a running cluster (setup via `hack/ate-dev-env.sh.example` and `go run ./tools/setup-gcp bootstrap`).
 5. A test that skips when a precondition is missing — Docker, a cluster, an artifact directory — must **fail** on it in CI, because a skip and a pass are the same exit code. Resolve strictness through a named predicate rather than an inline `os.Getenv("CI")`; `cmd/ateapi/internal/store/dockerenv.Required()` is the reference implementation. Prove the strict branch red before merging: a guard only ever observed passing is not known to guard anything. See `docs/dev/best-practices/ci-fail-closed.md`.
+6. The store has a PostgreSQL backend (`cmd/ateapi/internal/store/atepg`) and a MySQL backend (`cmd/ateapi/internal/store/atemy`). Make every store or schema change in both, following `docs/dev/schema-evolution.md`. Store-backed suites use PostgreSQL by default; run them with `ATE_TEST_STORE_BACKEND=mysql` too, as CI does for `./cmd/ateapi/internal/controlapi/...` and `./cmd/ateapi/internal/workerservice/...`.
 
 ## Security Considerations
 

CONTRIBUTING.md

@@ -86,7 +86,7 @@ for this purpose.
 All code changes should be accompanied by tests. We will not merge code that
 does not have tests, and we will not merge code that causes tests to fail.
 
-Follow the [PostgreSQL schema evolution rules](docs/dev/postgresql-schema-evolution.md) for each application schema change.
+Follow the [schema evolution rules](docs/dev/schema-evolution.md) for each application schema change. Make each change in both the PostgreSQL and MySQL migrations.
 
 Each pull request title becomes its line in the [release notes](docs/dev/release-notes.md).
 

README.md

@@ -192,6 +192,7 @@ go run ./tools/setup-gcp create bucket
 
 To run the PostgreSQL store backend on Cloud SQL — with IAM database
 authentication and no passwords — see [tools/setup-gcp/cloud-sql.md](tools/setup-gcp/cloud-sql.md).
+To use an external MySQL 8.0+ or PlanetScale database instead, see [docs/mysql.md](docs/mysql.md).
 
 Similarly, you can deploy or cleanup specific Agent Substrate components using the installation script. See `./hack/install-ate.sh --help` for all options.
 ```bash

_LICENSES/filippo.io/edwards25519/LICENSE

@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

_LICENSES/github.com/go-sql-driver/mysql/.github/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing Guidelines
+
+## Reporting Issues
+
+Before creating a new Issue, please check first if a similar Issue [already exists](https://github.com/go-sql-driver/mysql/issues?state=open) or was [recently closed](https://github.com/go-sql-driver/mysql/issues?direction=desc&page=1&sort=updated&state=closed).
+
+## Contributing Code
+
+By contributing to this project, you share your code under the Mozilla Public License 2, as specified in the LICENSE file.
+Don't forget to add yourself to the AUTHORS file.
+
+### Code Review
+
+Everyone is invited to review and comment on pull requests.
+If it looks fine to you, comment with "LGTM" (Looks good to me).
+
+If changes are required, notice the reviewers with "PTAL" (Please take another look) after committing the fixes.
+
+Before merging the Pull Request, at least one [team member](https://github.com/go-sql-driver?tab=members) must have commented with "LGTM".
+
+## Development Ideas
+
+If you are looking for ideas for code contributions, please check our [Development Ideas](https://github.com/go-sql-driver/mysql/wiki/Development-Ideas) Wiki page.

_LICENSES/github.com/go-sql-driver/mysql/.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,21 @@
+### Issue description
+Tell us what should happen and what happens instead
+
+### Example code
+```go
+If possible, please enter some example code here to reproduce the issue.
+```
+
+### Error log
+```
+If you have an error log, please paste it here.
+```
+
+### Configuration
+*Driver version (or git SHA):*
+
+*Go version:* run `go version` in your console
+
+*Server version:* E.g. MySQL 5.6, MariaDB 10.0.20
+
+*Server OS:* E.g. Debian 8.1 (Jessie), Windows 10

_LICENSES/github.com/go-sql-driver/mysql/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,9 @@
+### Description
+Please explain the changes you made here.
+
+### Checklist
+- [ ] Code compiles correctly
+- [ ] Created tests which fail without the change (if possible)
+- [ ] All tests passing
+- [ ] Extended the README / documentation, if necessary
+- [ ] Added myself / the copyright holder to the AUTHORS file

_LICENSES/github.com/go-sql-driver/mysql/.github/dependabot.yml

@@ -0,0 +1,24 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"

_LICENSES/github.com/go-sql-driver/mysql/.github/workflows/test.yml

@@ -0,0 +1,118 @@
+name: test
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+env:
+  MYSQL_TEST_USER: gotest
+  MYSQL_TEST_PASS: secret
+  MYSQL_TEST_ADDR: 127.0.0.1:3306
+  MYSQL_TEST_CONCURRENT: 1
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1
+
+  list:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: list
+        id: set-matrix
+        run: |
+          import json
+          import os
+          go = [
+              # Keep the most recent production release at the top
+              '1.26',
+              # Older production releases
+              '1.25',
+              '1.24',
+          ]
+          mysql = [
+              '9.0',
+              '8.4', # LTS
+              '8.0',
+              '5.7',
+              'mariadb-12.3',   # LTS
+              'mariadb-11.8',   # LTS
+              'mariadb-11.4',   # LTS
+              'mariadb-10.11',  # LTS
+              'mariadb-10.6',   # LTS
+              'mariadb-10.5',   # LTS
+          ]
+
+          includes = []
+          # Go versions compatibility check
+          for v in go[1:]:
+              includes.append({'os': 'ubuntu-latest', 'go': v, 'mysql': mysql[0]})
+
+          matrix = {
+              # OS vs MySQL versions
+              'os': [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ],
+              'go': [ go[0] ],
+              'mysql': mysql,
+
+              'include': includes
+          }
+          output = json.dumps(matrix, separators=(',', ':'))
+          with open(os.environ["GITHUB_OUTPUT"], 'a', encoding="utf-8") as f:
+              print(f"matrix={output}", file=f)
+        shell: python
+  test:
+    needs: list
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.list.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ matrix.go }}
+      - uses: shogo82148/actions-setup-mysql@62da9377d83991fce27b6ed2a397d3306121e41d # v1.53.1
+        with:
+          mysql-version: ${{ matrix.mysql }}
+          user: ${{ env.MYSQL_TEST_USER }}
+          password: ${{ env.MYSQL_TEST_PASS }}
+          my-cnf: |
+            innodb_log_file_size=256MB
+            innodb_buffer_pool_size=512MB
+            max_allowed_packet=48MB
+            ; TestConcurrent fails if max_connections is too large
+            max_connections=50
+            local_infile=1
+            performance_schema=on
+      - name: setup database
+        run: |
+          mysql --user 'root' --host '127.0.0.1' -e 'create database gotest;'
+
+      - name: test
+        run: |
+          go test -v '-race' '-covermode=atomic' '-coverprofile=coverage.out' -parallel 10
+
+      - name: benchmark
+        run: |
+          go test -run '^$' -bench .
+
+      - name: Send coverage
+        uses: shogo82148/actions-goveralls@8781f5dd05b691c4dd042d5e859c11c73e0104fa # v1.11.1
+        with:
+          path-to-profile: coverage.out
+          flag-name: ${{ runner.os }}-Go-${{ matrix.go }}-DB-${{ matrix.mysql }}
+          parallel: true
+
+  # notifies that all test jobs are finished.
+  finish:
+    needs: test
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: shogo82148/actions-goveralls@8781f5dd05b691c4dd042d5e859c11c73e0104fa # v1.11.1
+        with:
+          parallel-finished: true

_LICENSES/github.com/go-sql-driver/mysql/.gitignore

@@ -0,0 +1,9 @@
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+Icon?
+ehthumbs.db
+Thumbs.db
+.idea