Merge remote-tracking branch 'gitea/main' into codex/security-supply-chain-contracts-20260512

apps/api/src/services/channel_hub.py

@@ -489,6 +489,11 @@ async def record_outbound_message(
     source_envelope_json = json.dumps(envelope, ensure_ascii=False, default=str)
 
     actual_status = "shadow" if is_shadow else send_status
+    sent_at = (
+        datetime.now(UTC).replace(tzinfo=None)
+        if actual_status == "sent"
+        else None
+    )
 
     await ensure_completed_shadow_run(
         db,
@@ -522,8 +527,7 @@ async def record_outbound_message(
                 :content_hash, :content_preview, :content_redacted,
                 :redaction_version, CAST(:source_envelope AS jsonb),
                 :provider_message_id,
-                :send_status, NOW(),
-                CASE WHEN CAST(:send_status AS text) = 'sent' THEN NOW() ELSE NULL END,
+                :send_status, NOW(), :sent_at,
                 :triggered_by_state, :waiting_since
             )
             RETURNING message_id
@@ -542,6 +546,7 @@ async def record_outbound_message(
             "source_envelope": source_envelope_json,
             "provider_message_id": provider_message_id,
             "send_status": actual_status,
+            "sent_at": sent_at,
             "triggered_by_state": triggered_by_state,
             "waiting_since": waiting_since,
         },

apps/api/tests/test_channel_hub_grouped_alert_events.py

@@ -132,5 +132,7 @@ async def test_record_outbound_message_sets_sent_at_for_sent_messages() -> None:
 
     insert_statement = session.statements[-1]
     assert "sent_at" in insert_statement
-    assert "CASE WHEN CAST(:send_status AS text) = 'sent' THEN NOW() ELSE NULL END" in insert_statement
+    assert ":sent_at" in insert_statement
     assert session.param_sets[-1]["send_status"] == "sent"
+    assert session.param_sets[-1]["sent_at"] is not None
+    assert session.param_sets[-1]["sent_at"].tzinfo is None

docs/LOGBOOK.md

@@ -7630,6 +7630,7 @@ OK
 **production smoke 途中補修**：
 
 - rollback transaction smoke 抓到 asyncpg bind parameter 型別推論問題：`CASE WHEN :send_status = 'sent'` 會被推成 text/varchar ambiguous。
-- 已改成 `CASE WHEN CAST(:send_status AS text) = 'sent' THEN NOW() ELSE NULL END`，避免 outbound mirror 在 production 寫入時失敗。
+- 第一版 `CAST(:send_status AS text)` 仍會因同一 bind param 同時插入 varchar 與比較而 ambiguous；最終改成 Python 端計算 `sent_at` 參數，SQL 只插入 `:sent_at`，避免 outbound mirror 在 production 寫入時失敗。
+- 第二次 rollback smoke 抓到 DB 欄位是 `timestamp without time zone`，已改成 naive UTC `datetime.now(UTC).replace(tzinfo=None)`，避免 asyncpg timezone-aware bind 失敗。
 
 **目前整體進度**：約 69%。

k8s/awoooi-prod/kustomization.yaml

@@ -40,7 +40,7 @@ resources:
 images:
 - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/api
-  newTag: 7fa9f743ddaaa16c9f9225ecff8816a014b8bc25
+  newTag: d449ba4720c23424a43366b284175da88fd861bc
 - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/web
-  newTag: 7fa9f743ddaaa16c9f9225ecff8816a014b8bc25
+  newTag: d449ba4720c23424a43366b284175da88fd861bc