Load limiting safeguards

api/routers/state.py

@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends
 from fastapi.responses import JSONResponse
 from sqlalchemy import func, select, text
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import noload, selectinload
 
 from api.database import get_session, engine
 from api.flow_defs import assertion_result_to_dict, load_flow
@@ -33,7 +34,7 @@ from api.schemas.state import (
     WorkstreamTotals,
 )
 from api.schemas.task import TaskRead
-from api.schemas.topic import TopicWithWorkstreams
+from api.schemas.topic import TopicRead, TopicWithWorkstreams
 from api.schemas.workstream import WorkstreamRead, WorkstreamWithTaskCounts, WorkstreamWithDeps
 from api.schemas.workstream_dependency import WorkstreamDepStub
 from task_flow_engine import FlowEngine
@@ -47,9 +48,43 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
     # AsyncSession does not support concurrent operations (no gather on same session).
 
     topics_rows = await session.execute(
-        select(Topic).where(Topic.status != TopicStatus.archived).order_by(Topic.created_at)
+        select(Topic)
+        .options(
+            selectinload(Topic.domain),
+            noload(Topic.workstreams),
+            noload(Topic.decisions),
+            noload(Topic.progress_events),
+        )
+        .where(Topic.status != TopicStatus.archived)
+        .order_by(Topic.created_at)
     )
     topics = list(topics_rows.scalars().all())
+    topic_ids = [t.id for t in topics]
+
+    topic_workstreams: dict = {t.id: [] for t in topics}
+    if topic_ids:
+        topic_ws_rows = await session.execute(
+            select(
+                Workstream.topic_id,
+                Workstream.id,
+                Workstream.slug,
+                Workstream.title,
+                Workstream.status,
+                Workstream.owner,
+                Workstream.due_date,
+            )
+            .where(Workstream.topic_id.in_(topic_ids))
+            .order_by(Workstream.created_at)
+        )
+        for topic_id, ws_id, slug, title, status, owner, due_date in topic_ws_rows:
+            topic_workstreams.setdefault(topic_id, []).append({
+                "id": ws_id,
+                "slug": slug,
+                "title": title,
+                "status": status,
+                "owner": owner,
+                "due_date": due_date,
+            })
 
     blocking_rows = await session.execute(
         select(Decision)
@@ -60,17 +95,18 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
     blocking = list(blocking_rows.scalars().all())
 
     blocked_rows = await session.execute(
-        select(Task).where(Task.status == TaskStatus.blocked).order_by(Task.created_at)
+        select(Task).options(noload("*")).where(Task.status == TaskStatus.blocked).order_by(Task.created_at)
     )
     blocked = list(blocked_rows.scalars().all())
 
     recent_rows = await session.execute(
-        select(ProgressEvent).order_by(ProgressEvent.created_at.desc()).limit(20)
+        select(ProgressEvent).options(noload("*")).order_by(ProgressEvent.created_at.desc()).limit(20)
     )
     recent = list(recent_rows.scalars().all())
 
     open_ws_rows = await session.execute(
         select(Workstream)
+        .options(noload("*"))
         .where(Workstream.status.in_(["active", "blocked"]))
         .order_by(Workstream.due_date.asc().nullslast(), Workstream.created_at)
     )
@@ -78,10 +114,12 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
 
     # Task counts per workstream (used to enrich open_workstreams)
     task_per_ws: dict = {}
+    task_statuses_per_ws: dict = {}
     for ws_id, tstat, cnt in await session.execute(
         select(Task.workstream_id, Task.status, func.count()).group_by(Task.workstream_id, Task.status)
     ):
         task_per_ws.setdefault(ws_id, {})[tstat] = cnt
+        task_statuses_per_ws.setdefault(ws_id, []).extend([_value(tstat)] * cnt)
 
     # Dependency graph for open workstreams
     open_ws_ids = [w.id for w in open_ws]
@@ -108,7 +146,7 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
     extra_ids = dep_ws_ids - set(ws_lookup.keys())
     if extra_ids:
         extra_rows = await session.execute(
-            select(Workstream).where(Workstream.id.in_(extra_ids))
+            select(Workstream).options(noload("*")).where(Workstream.id.in_(extra_ids))
         )
         for w in extra_rows.scalars():
             ws_lookup[w.id] = w
@@ -159,7 +197,7 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
         flow_obj = {
             "status": w.status,
             "workstation": w.status,
-            "tasks": [{"status": _value(t.status)} for t in w.tasks],
+            "tasks": [{"status": status} for status in task_statuses_per_ws.get(w.id, [])],
             "dependencies": [
                 {"workstation": ws_lookup[d.to_workstream_id].status}
                 for d in dep_rows
@@ -259,7 +297,13 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
     return StateSummary(
         generated_at=datetime.now(tz=timezone.utc),
         totals=totals,
-        topics=[TopicWithWorkstreams.model_validate(t) for t in topics],
+        topics=[
+            TopicWithWorkstreams(
+                **TopicRead.model_validate(t).model_dump(),
+                workstreams=topic_workstreams.get(t.id, []),
+            )
+            for t in topics
+        ],
         blocking_decisions=[DecisionRead.model_validate(d) for d in blocking],
         blocked_tasks=[TaskRead.model_validate(t) for t in blocked],
         recent_progress=[ProgressEventRead.model_validate(e) for e in recent],
@@ -291,7 +335,7 @@ async def get_summary(session: AsyncSession = Depends(get_session)) -> StateSumm
 async def _build_domain_summaries(session: AsyncSession) -> list[DomainSummary]:
     """Compute per-domain stats for the state summary."""
     domains_rows = await session.execute(
-        select(Domain).where(Domain.status == "active").order_by(Domain.name)
+        select(Domain).options(noload("*")).where(Domain.status == "active").order_by(Domain.name)
     )
     domains = list(domains_rows.scalars().all())
 
@@ -357,14 +401,17 @@ async def _derive_next_steps(session: AsyncSession) -> list[NextStep]:
     cutoff = datetime.now(tz=timezone.utc) - timedelta(days=7)
     resolved_rows = await session.execute(
         select(Decision)
+        .options(noload("*"))
         .where(Decision.status == DecisionStatus.resolved)
         .where(Decision.decided_at >= cutoff)
         .where(Decision.workstream_id.isnot(None))
         .order_by(Decision.decided_at.desc())
+        .limit(20)
     )
     for decision in resolved_rows.scalars().all():
         open_tasks_rows = await session.execute(
             select(Task)
+            .options(noload("*"))
             .where(Task.workstream_id == decision.workstream_id)
             .where(Task.status.in_([TaskStatus.todo, TaskStatus.in_progress]))
         )
@@ -374,7 +421,7 @@ async def _derive_next_steps(session: AsyncSession) -> list[NextStep]:
         task = min(open_tasks, key=lambda t: (_PRIORITY_RANK.get(t.priority, 99), t.created_at))
         if task.id in seen_task_ids:
             continue
-        ws = await session.get(Workstream, decision.workstream_id)
+        ws = await session.get(Workstream, decision.workstream_id, options=[noload("*")])
         domain_slug = await _get_domain_slug_for_workstream(ws, session)
         steps.append(NextStep(
             type="resolved_decision",
@@ -392,57 +439,85 @@ async def _derive_next_steps(session: AsyncSession) -> list[NextStep]:
         seen_task_ids.add(task.id)
 
     # ── Signal 2: cleared dependencies ──────────────────────────────────────
-    all_dep_rows = await session.execute(select(WorkstreamDependency))
-    all_deps = list(all_dep_rows.scalars().all())
+    all_dep_rows = await session.execute(
+        select(
+            WorkstreamDependency.from_workstream_id,
+            WorkstreamDependency.to_workstream_id,
+        ).where(WorkstreamDependency.to_workstream_id.isnot(None))
+    )
+    all_deps = all_dep_rows.all()
 
     # Group from_workstream_id → set of to_workstream_ids
     dep_map: dict = {}
-    for d in all_deps:
-        dep_map.setdefault(d.from_workstream_id, set()).add(d.to_workstream_id)
+    dep_ws_ids = set()
+    for from_ws_id, to_ws_id in all_deps:
+        dep_map.setdefault(from_ws_id, set()).add(to_ws_id)
+        dep_ws_ids.add(from_ws_id)
+        dep_ws_ids.add(to_ws_id)
 
-    for from_ws_id, to_ws_ids in dep_map.items():
-        # All targets must be completed
-        all_done = True
-        for to_id in to_ws_ids:
-            to_ws = await session.get(Workstream, to_id)
-            if to_ws is None or to_ws.status != "completed":
-                all_done = False
-                break
-        if not all_done:
-            continue
+    ws_info = {}
+    if dep_ws_ids:
+        ws_rows = await session.execute(
+            select(
+                Workstream.id,
+                Workstream.status,
+                Workstream.title,
+                Workstream.slug,
+                Workstream.topic_id,
+            ).where(Workstream.id.in_(dep_ws_ids))
+        )
+        ws_info = {
+            ws_id: {
+                "status": status,
+                "title": title,
+                "slug": slug,
+                "topic_id": topic_id,
+            }
+            for ws_id, status, title, slug, topic_id in ws_rows
+        }
 
-        from_ws = await session.get(Workstream, from_ws_id)
-        if from_ws is None or from_ws.status not in ("active", "blocked"):
-            continue
+    ready_from_ws_ids = [
+        from_ws_id
+        for from_ws_id, to_ws_ids in dep_map.items()
+        if ws_info.get(from_ws_id, {}).get("status") in ("active", "blocked")
+        and all(ws_info.get(to_id, {}).get("status") == "completed" for to_id in to_ws_ids)
+    ]
 
+    todo_by_ws: dict = {}
+    if ready_from_ws_ids:
         todo_rows = await session.execute(
             select(Task)
-            .where(Task.workstream_id == from_ws_id)
+            .options(noload("*"))
+            .where(Task.workstream_id.in_(ready_from_ws_ids))
             .where(Task.status == TaskStatus.todo)
         )
-        todo_tasks = list(todo_rows.scalars().all())
+        for task in todo_rows.scalars().all():
+            todo_by_ws.setdefault(task.workstream_id, []).append(task)
+
+    for from_ws_id in ready_from_ws_ids:
+        from_ws = ws_info.get(from_ws_id, {})
+        todo_tasks = todo_by_ws.get(from_ws_id, [])
         if not todo_tasks:
             continue
         task = min(todo_tasks, key=lambda t: (_PRIORITY_RANK.get(t.priority, 99), t.created_at))
         if task.id in seen_task_ids:
             continue
-        domain_slug = await _get_domain_slug_for_workstream(from_ws, session)
+        domain_slug = await _get_domain_slug_for_topic(from_ws.get("topic_id"), session)
         _blocker_slugs = []
-        for tid in to_ws_ids:
-            _ws = await session.get(Workstream, tid)
-            if _ws:
-                _blocker_slugs.append(_ws.slug)
+        for tid in dep_map[from_ws_id]:
+            if tid in ws_info:
+                _blocker_slugs.append(ws_info[tid]["slug"])
         blocker_slugs = ", ".join(_blocker_slugs)
         steps.append(NextStep(
             type="dependency_cleared",
             domain=domain_slug,
-            workstream_id=from_ws.id,
-            workstream_title=from_ws.title,
-            workstream_slug=from_ws.slug,
+            workstream_id=from_ws_id,
+            workstream_title=from_ws["title"],
+            workstream_slug=from_ws["slug"],
             task_id=task.id,
             task_title=task.title,
             message=(
-                f"All dependencies of '{from_ws.title}' are completed ({blocker_slugs}) → "
+                f"All dependencies of '{from_ws['title']}' are completed ({blocker_slugs}) → "
                 f"'{task.title}' is ready to start"
             ),
         ))
@@ -455,10 +530,17 @@ async def _get_domain_slug_for_workstream(ws: Workstream | None, session: AsyncS
     """Get the domain slug for a workstream via its topic."""
     if ws is None or ws.topic_id is None:
         return None
-    topic = await session.get(Topic, ws.topic_id)
+    return await _get_domain_slug_for_topic(ws.topic_id, session)
+
+
+async def _get_domain_slug_for_topic(topic_id, session: AsyncSession) -> str | None:
+    """Get the domain slug for a topic id."""
+    if topic_id is None:
+        return None
+    topic = await session.get(Topic, topic_id, options=[noload("*")])
     if topic is None or topic.domain_id is None:
         return None
-    domain = await session.get(Domain, topic.domain_id)
+    domain = await session.get(Domain, topic.domain_id, options=[noload("*")])
     return domain.slug if domain else None