[girish1430]

Repository observations need to retain forge measurements while recalculating current audit age, findings, risk and exposure. Add portfolio_forge_facts to Contracts' SQLite and PostgreSQL storage schemas for XWING-2214.

• Store the latest forge facts and their audit-baseline context; derived RepoState is not persisted.
• Preserve unknown measurements as NULL and keep filings without repository URLs distinct.
• Add an explicit storage revision 1 → 2 migration that preserves existing records, and release metadata for 0.54.0.
• Keep storage and migration guidance in the existing README and changelog.

Validation: lint passed; the latest test run passed 521 tests, with 43 skipped because local PostgreSQL was unavailable. An earlier PostgreSQL-enabled run passed 564 tests.

Merge order: this PR → Core #5 → Traust #58.

• Review observation lookup keys and baseline-context columns.
• Reconcile downstream dependency pins after merge if commit IDs change.

[chubirka]

LGTM for the Contracts storage change. Reviewed commit 2759c35.

This adds persistence for the latest GitHub/GitLab repository observations and their audit-baseline context, while leaving derived repository state to Core.

Verification performed:

• SQLite smoke using a genuine revision-1 database: upgrade to revision 2 preserved product/repository records, artifact evidence, bindings, and report projections. Migrated schema matched fresh initialization, and repeat migration was idempotent.
• An injected migration failure rolled back schema changes and the revision stamp.
• Observation insert/read/update/reopen worked; lookup uniqueness was enforced; URL-less filings remained distinct; NULL remained distinguishable from false and zero.
• Regression suite: 521 passed, 43 PostgreSQL tests skipped because no local server was available. Existing sibling Traust configuration fixtures were supplied to the isolated checkout.
• Ruff lint and formatting checks passed.

Recommended test correction: add an actual PostgreSQL revision-1 -> revision-2 migration regression that verifies existing records survive and the migrated schema matches fresh initialization. The new upgrade test covers SQLite only, while test_postgres_migrate_bootstraps_empty_and_runs_a_step now exercises a synthetic revision-2 -> revision-3 step. Please obtain a PostgreSQL-enabled passing run as well.

No functional defect was found in the exercised SQLite paths. PostgreSQL runtime behavior was not independently verified in this review.

/lgtm

[chubirka]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka, girish1430

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka,girish1430]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment