feat: vcs and secret management support

11 files changed, 2252 insertions, 89 deletions

diff --git a/src/marlin.web/Migrations/20260902214847_InitialCreate.Designer.cs b/src/marlin.web/Migrations/20260902214847_InitialCreate.Designer.cs
deleted file mode 100644
index 21ab701..0000000
--- a/src/marlin.web/Migrations/20260902214847_InitialCreate.Designer.cs
+++ /dev/null
@@ -1,53 +0,0 @@
-// <auto-generated />
-using System;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-using marlin.web.Data;
-
-#nullable disable
-
-namespace marlin.web.Migrations
-{
-    [DbContext(typeof(ApplicationDbContext))]
-    [Migration("20260902214847_InitialCreate")]
-    partial class InitialCreate
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.11")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("marlin.core.VersionControlSource", b =>
-                {
-                    b.Property<Guid>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("uuid")
-                        .HasColumnName("id");
-
-                    b.Property<string>("BranchFilter")
-                        .IsRequired()
-                        .HasColumnType("text")
-                        .HasColumnName("branch_filter");
-
-                    b.Property<string>("UpstreamUrl")
-                        .IsRequired()
-                        .HasColumnType("text")
-                        .HasColumnName("upstream_url");
-
-                    b.HasKey("Id")
-                        .HasName("pk_sources");
-
-                    b.ToTable("sources", (string)null);
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/src/marlin.web/Migrations/20260902214847_InitialCreate.cs b/src/marlin.web/Migrations/20260902214847_InitialCreate.cs
deleted file mode 100644
index 6c91890..0000000
--- a/src/marlin.web/Migrations/20260902214847_InitialCreate.cs
+++ /dev/null
@@ -1,35 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace marlin.web.Migrations
-{
-    /// <inheritdoc />
-    public partial class InitialCreate : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.CreateTable(
-                name: "sources",
-                columns: table => new
-                {
-                    id = table.Column<Guid>(type: "uuid", nullable: false),
-                    upstream_url = table.Column<string>(type: "text", nullable: false),
-                    branch_filter = table.Column<string>(type: "text", nullable: false)
-                },
-                constraints: table =>
-                {
-                    table.PrimaryKey("pk_sources", x => x.id);
-                });
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropTable(
-                name: "sources");
-        }
-    }
-}
diff --git a/src/marlin.web/Migrations/20260903141622_InitialCreate.Designer.cs b/src/marlin.web/Migrations/20260903141622_InitialCreate.Designer.cs
new file mode 100644
index 0000000..ad71457
--- /dev/null
+++ b/src/marlin.web/Migrations/20260903141622_InitialCreate.Designer.cs
@@ -0,0 +1,259 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260903141622_InitialCreate")]
+    partial class InitialCreate
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("HeadCommit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("head_commit");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260903141622_InitialCreate.cs b/src/marlin.web/Migrations/20260903141622_InitialCreate.cs
new file mode 100644
index 0000000..2ebcc67
--- /dev/null
+++ b/src/marlin.web/Migrations/20260903141622_InitialCreate.cs
@@ -0,0 +1,154 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class InitialCreate : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "agents",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    name = table.Column<string>(type: "text", nullable: false),
+                    max_concurrent_jobs = table.Column<int>(type: "integer", nullable: false),
+                    last_seen = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    capabilities = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_agents", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "sources",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    upstream_url = table.Column<string>(type: "text", nullable: false),
+                    main_branch = table.Column<string>(type: "text", nullable: false),
+                    branch_filter = table.Column<string>(type: "text", nullable: false),
+                    min_polling_interval = table.Column<int>(type: "integer", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_sources", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "jobs",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    source_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    @ref = table.Column<string>(name: "ref", type: "text", nullable: false),
+                    commit = table.Column<string>(type: "text", nullable: false),
+                    created_reason = table.Column<string>(type: "text", nullable: false),
+                    created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    status = table.Column<int>(type: "integer", nullable: false),
+                    agent_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    recipe = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_jobs", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_jobs_agents_agent_id",
+                        column: x => x.agent_id,
+                        principalTable: "agents",
+                        principalColumn: "id");
+                    table.ForeignKey(
+                        name: "fk_jobs_sources_source_id",
+                        column: x => x.source_id,
+                        principalTable: "sources",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "source_branches",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    source_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    name = table.Column<string>(type: "text", nullable: false),
+                    head_commit = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_source_branches", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_source_branches_sources_source_id",
+                        column: x => x.source_id,
+                        principalTable: "sources",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "job_status_update",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    job_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    status = table.Column<int>(type: "integer", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_job_status_update", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_job_status_update_jobs_job_id",
+                        column: x => x.job_id,
+                        principalTable: "jobs",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_job_status_update_job_id",
+                table: "job_status_update",
+                column: "job_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_jobs_agent_id",
+                table: "jobs",
+                column: "agent_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_jobs_source_id",
+                table: "jobs",
+                column: "source_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_source_branches_source_id",
+                table: "source_branches",
+                column: "source_id");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "job_status_update");
+
+            migrationBuilder.DropTable(
+                name: "source_branches");
+
+            migrationBuilder.DropTable(
+                name: "jobs");
+
+            migrationBuilder.DropTable(
+                name: "agents");
+
+            migrationBuilder.DropTable(
+                name: "sources");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905011100_AddCommitModel.Designer.cs b/src/marlin.web/Migrations/20260905011100_AddCommitModel.Designer.cs
new file mode 100644
index 0000000..03f789e
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905011100_AddCommitModel.Designer.cs
@@ -0,0 +1,376 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260905011100_AddCommitModel")]
+    partial class AddCommitModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905011100_AddCommitModel.cs b/src/marlin.web/Migrations/20260905011100_AddCommitModel.cs
new file mode 100644
index 0000000..78a23d0
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905011100_AddCommitModel.cs
@@ -0,0 +1,126 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddCommitModel : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "head_commit",
+                table: "source_branches");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "commit_id",
+                table: "source_branches",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateTable(
+                name: "source_commits",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    source_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    blobs_fetched = table.Column<bool>(type: "boolean", nullable: false),
+                    hash = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_source_commits", x => x.id);
+                    table.UniqueConstraint("ak_source_commits_source_id_hash", x => new { x.source_id, x.hash });
+                    table.ForeignKey(
+                        name: "fk_source_commits_sources_source_id",
+                        column: x => x.source_id,
+                        principalTable: "sources",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "source_blobs",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    source_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    commit_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    path = table.Column<string>(type: "text", nullable: false),
+                    content = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_source_blobs", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_source_blobs_source_commits_commit_id",
+                        column: x => x.commit_id,
+                        principalTable: "source_commits",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "fk_source_blobs_sources_source_id",
+                        column: x => x.source_id,
+                        principalTable: "sources",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_source_branches_commit_id",
+                table: "source_branches",
+                column: "commit_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_source_blobs_commit_id",
+                table: "source_blobs",
+                column: "commit_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_source_blobs_source_id",
+                table: "source_blobs",
+                column: "source_id");
+
+            migrationBuilder.AddForeignKey(
+                name: "fk_source_branches_source_commits_commit_id",
+                table: "source_branches",
+                column: "commit_id",
+                principalTable: "source_commits",
+                principalColumn: "id",
+                onDelete: ReferentialAction.Cascade);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "fk_source_branches_source_commits_commit_id",
+                table: "source_branches");
+
+            migrationBuilder.DropTable(
+                name: "source_blobs");
+
+            migrationBuilder.DropTable(
+                name: "source_commits");
+
+            migrationBuilder.DropIndex(
+                name: "ix_source_branches_commit_id",
+                table: "source_branches");
+
+            migrationBuilder.DropColumn(
+                name: "commit_id",
+                table: "source_branches");
+
+            migrationBuilder.AddColumn<string>(
+                name: "head_commit",
+                table: "source_branches",
+                type: "text",
+                nullable: false,
+                defaultValue: "");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905102259_AddSecretModel.Designer.cs b/src/marlin.web/Migrations/20260905102259_AddSecretModel.Designer.cs
new file mode 100644
index 0000000..142703a
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905102259_AddSecretModel.Designer.cs
@@ -0,0 +1,430 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260905102259_AddSecretModel")]
+    partial class AddSecretModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905102259_AddSecretModel.cs b/src/marlin.web/Migrations/20260905102259_AddSecretModel.cs
new file mode 100644
index 0000000..8b09e89
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905102259_AddSecretModel.cs
@@ -0,0 +1,59 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSecretModel : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<Guid>(
+                name: "access_secret_id",
+                table: "sources",
+                type: "uuid",
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "secrets",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    source_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    may_reveal = table.Column<bool>(type: "boolean", nullable: false),
+                    kind = table.Column<string>(type: "text", nullable: true),
+                    label = table.Column<string>(type: "text", nullable: false),
+                    content = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_secrets", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_secrets_sources_source_id",
+                        column: x => x.source_id,
+                        principalTable: "sources",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_secrets_source_id",
+                table: "secrets",
+                column: "source_id");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "secrets");
+
+            migrationBuilder.DropColumn(
+                name: "access_secret_id",
+                table: "sources");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905104308_BlobNowBinary.Designer.cs b/src/marlin.web/Migrations/20260905104308_BlobNowBinary.Designer.cs
new file mode 100644
index 0000000..6061a9d
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905104308_BlobNowBinary.Designer.cs
@@ -0,0 +1,430 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260905104308_BlobNowBinary")]
+    partial class BlobNowBinary
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260905104308_BlobNowBinary.cs b/src/marlin.web/Migrations/20260905104308_BlobNowBinary.cs
new file mode 100644
index 0000000..493e698
--- /dev/null
+++ b/src/marlin.web/Migrations/20260905104308_BlobNowBinary.cs
@@ -0,0 +1,40 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class BlobNowBinary : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "content",
+                table: "source_blobs");
+
+            migrationBuilder.AddColumn<byte[]>(
+                name: "content",
+                table: "source_blobs",
+                type: "bytea",
+                nullable: false,
+                defaultValue: new byte[0]);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "content",
+                table: "source_blobs");
+
+            migrationBuilder.AddColumn<string>(
+                name: "content",
+                table: "source_blobs",
+                type: "text",
+                nullable: false,
+                defaultValue: "");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs b/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
index 4c026e5..8de35de 100644
--- a/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
+++ b/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
@@ -22,18 +22,145 @@ namespace marlin.web.Migrations
 
             NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
 
-            modelBuilder.Entity("marlin.core.VersionControlSource", b =>
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("uuid")
                         .HasColumnName("id");
 
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
                     b.Property<string>("BranchFilter")
                         .IsRequired()
                         .HasColumnType("text")
                         .HasColumnName("branch_filter");
 
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
                     b.Property<string>("UpstreamUrl")
                         .IsRequired()
                         .HasColumnType("text")
@@ -44,6 +171,256 @@ namespace marlin.web.Migrations
 
                     b.ToTable("sources", (string)null);
                 });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+                });
 #pragma warning restore 612, 618
         }
     }