refactor: cleanup; feat: connection to agent

7 files changed, 1827 insertions, 60 deletions

diff --git a/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.Designer.cs b/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.Designer.cs
new file mode 100644
index 0000000..e50bdbd
--- /dev/null
+++ b/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.Designer.cs
@@ -0,0 +1,478 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260906003038_AddWorkflowSnapshot")]
+    partial class AddWorkflowSnapshot
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<bool>("WorkflowScanned")
+                        .HasColumnType("boolean")
+                        .HasColumnName("workflow_scanned");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.WorkflowSnapshot", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<DateTime>("ScannedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("scanned_at");
+
+                    b.Property<string>("Workflow")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("workflow");
+
+                    b.HasKey("Id")
+                        .HasName("pk_workflow_snapshots");
+
+                    b.HasIndex("CommitId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_workflow_snapshots_commit_id");
+
+                    b.ToTable("workflow_snapshots", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.WorkflowSnapshot", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithOne("WorkflowSnapshot")
+                        .HasForeignKey("marlin.core.models.WorkflowSnapshot", "CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_workflow_snapshots_source_commits_commit_id");
+
+                    b.Navigation("Commit");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+
+                    b.Navigation("WorkflowSnapshot");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.cs b/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.cs
new file mode 100644
index 0000000..d47ee9e
--- /dev/null
+++ b/src/marlin.web/Migrations/20260906003038_AddWorkflowSnapshot.cs
@@ -0,0 +1,59 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddWorkflowSnapshot : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "workflow_scanned",
+                table: "source_commits",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.CreateTable(
+                name: "workflow_snapshots",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    commit_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    scanned_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    workflow = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_workflow_snapshots", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_workflow_snapshots_source_commits_commit_id",
+                        column: x => x.commit_id,
+                        principalTable: "source_commits",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_workflow_snapshots_commit_id",
+                table: "workflow_snapshots",
+                column: "commit_id",
+                unique: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "workflow_snapshots");
+
+            migrationBuilder.DropColumn(
+                name: "workflow_scanned",
+                table: "source_commits");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260906082039_AddAgentToken.Designer.cs b/src/marlin.web/Migrations/20260906082039_AddAgentToken.Designer.cs
new file mode 100644
index 0000000..c39db32
--- /dev/null
+++ b/src/marlin.web/Migrations/20260906082039_AddAgentToken.Designer.cs
@@ -0,0 +1,488 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260906082039_AddAgentToken")]
+    partial class AddAgentToken
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("AuthToken")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("auth_token");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<string>("Commit")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("commit");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<string>("Ref")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("ref");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<bool>("WorkflowScanned")
+                        .HasColumnType("boolean")
+                        .HasColumnName("workflow_scanned");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.WorkflowSnapshot", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<DateTime>("ScannedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("scanned_at");
+
+                    b.Property<string>("Workflow")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("workflow");
+
+                    b.HasKey("Id")
+                        .HasName("pk_workflow_snapshots");
+
+                    b.HasIndex("CommitId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_workflow_snapshots_commit_id");
+
+                    b.ToTable("workflow_snapshots", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.HasOne("marlin.core.models.Agent", "Agent")
+                        .WithMany("Jobs")
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.core.models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.WorkflowSnapshot", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                        .WithOne("WorkflowSnapshot")
+                        .HasForeignKey("marlin.core.models.WorkflowSnapshot", "CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_workflow_snapshots_source_commits_commit_id");
+
+                    b.Navigation("Commit");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Agent", b =>
+                {
+                    b.Navigation("Jobs");
+                });
+
+            modelBuilder.Entity("marlin.core.models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+
+                    b.Navigation("WorkflowSnapshot");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260906082039_AddAgentToken.cs b/src/marlin.web/Migrations/20260906082039_AddAgentToken.cs
new file mode 100644
index 0000000..6725186
--- /dev/null
+++ b/src/marlin.web/Migrations/20260906082039_AddAgentToken.cs
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddAgentToken : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "auth_token",
+                table: "agents",
+                type: "text",
+                nullable: false,
+                defaultValue: "");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "auth_token",
+                table: "agents");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260908142748_CommitAlt.Designer.cs b/src/marlin.web/Migrations/20260908142748_CommitAlt.Designer.cs
new file mode 100644
index 0000000..5b64d5d
--- /dev/null
+++ b/src/marlin.web/Migrations/20260908142748_CommitAlt.Designer.cs
@@ -0,0 +1,514 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using marlin.web.Data;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260908142748_CommitAlt")]
+    partial class CommitAlt
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.11")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("marlin.web.Models.Agent", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("AuthToken")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("auth_token");
+
+                    b.Property<string>("Capabilities")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("capabilities");
+
+                    b.Property<DateTime>("LastSeen")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("last_seen");
+
+                    b.Property<int>("MaxConcurrentJobs")
+                        .HasColumnType("integer")
+                        .HasColumnName("max_concurrent_jobs");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.HasKey("Id")
+                        .HasName("pk_agents");
+
+                    b.ToTable("agents", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AgentId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("agent_id");
+
+                    b.Property<Guid>("BranchId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("branch_id");
+
+                    b.Property<string>("ClaimToken")
+                        .HasColumnType("text")
+                        .HasColumnName("claim_token");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("CreatedReason")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("created_reason");
+
+                    b.Property<string>("Recipe")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("recipe");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_jobs");
+
+                    b.HasIndex("AgentId")
+                        .HasDatabaseName("ix_jobs_agent_id");
+
+                    b.HasIndex("BranchId")
+                        .HasDatabaseName("ix_jobs_branch_id");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_jobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_jobs_source_id");
+
+                    b.ToTable("jobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.JobStatusUpdate", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTime>("At")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("at");
+
+                    b.Property<Guid>("JobId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("job_id");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id")
+                        .HasName("pk_job_status_update");
+
+                    b.HasIndex("JobId")
+                        .HasDatabaseName("ix_job_status_update_job_id");
+
+                    b.ToTable("job_status_update", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSource", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("AccessSecretId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("access_secret_id");
+
+                    b.Property<string>("BranchFilter")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("branch_filter");
+
+                    b.Property<string>("MainBranch")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("main_branch");
+
+                    b.Property<int>("MinPollingInterval")
+                        .HasColumnType("integer")
+                        .HasColumnName("min_polling_interval");
+
+                    b.Property<string>("UpstreamUrl")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("upstream_url");
+
+                    b.HasKey("Id")
+                        .HasName("pk_sources");
+
+                    b.ToTable("sources", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBlob", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("path");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_blobs");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_blobs_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_blobs_source_id");
+
+                    b.ToTable("source_blobs", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBranch", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("name");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_branches");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_source_branches_commit_id");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_source_branches_source_id");
+
+                    b.ToTable("source_branches", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("BlobsFetched")
+                        .HasColumnType("boolean")
+                        .HasColumnName("blobs_fetched");
+
+                    b.Property<string>("Hash")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("hash");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.Property<bool>("WorkflowScanned")
+                        .HasColumnType("boolean")
+                        .HasColumnName("workflow_scanned");
+
+                    b.HasKey("Id")
+                        .HasName("pk_source_commits");
+
+                    b.HasAlternateKey("SourceId", "Hash")
+                        .HasName("ak_source_commits_source_id_hash");
+
+                    b.ToTable("source_commits", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.WorkflowSnapshot", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
+
+                    b.Property<DateTime>("ScannedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("scanned_at");
+
+                    b.Property<string>("Workflow")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("workflow");
+
+                    b.HasKey("Id")
+                        .HasName("pk_workflow_snapshots");
+
+                    b.HasIndex("CommitId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_workflow_snapshots_commit_id");
+
+                    b.ToTable("workflow_snapshots", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
+                {
+                    b.HasOne("marlin.web.Models.Agent", "Agent")
+                        .WithMany("Jobs")
+                        .HasForeignKey("AgentId")
+                        .HasConstraintName("fk_jobs_agents_agent_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlledBranch", "Branch")
+                        .WithMany()
+                        .HasForeignKey("BranchId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_source_branches_branch_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithMany()
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_sources_source_id");
+
+                    b.Navigation("Agent");
+
+                    b.Navigation("Branch");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.JobStatusUpdate", b =>
+                {
+                    b.HasOne("marlin.web.Models.Job", "Job")
+                        .WithMany("StatusUpdates")
+                        .HasForeignKey("JobId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_job_status_update_jobs_job_id");
+
+                    b.Navigation("Job");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithMany("Blobs")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_blobs_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBranch", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithMany("Branches")
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_source_commits_commit_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany("Branches")
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_branches_sources_source_id");
+
+                    b.Navigation("Commit");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_source_commits_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.WorkflowSnapshot", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithOne("WorkflowSnapshot")
+                        .HasForeignKey("marlin.web.Models.WorkflowSnapshot", "CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_workflow_snapshots_source_commits_commit_id");
+
+                    b.Navigation("Commit");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.Agent", b =>
+                {
+                    b.Navigation("Jobs");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
+                {
+                    b.Navigation("StatusUpdates");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSource", b =>
+                {
+                    b.Navigation("Branches");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
+                {
+                    b.Navigation("Blobs");
+
+                    b.Navigation("Branches");
+
+                    b.Navigation("WorkflowSnapshot");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/20260908142748_CommitAlt.cs b/src/marlin.web/Migrations/20260908142748_CommitAlt.cs
new file mode 100644
index 0000000..b607d31
--- /dev/null
+++ b/src/marlin.web/Migrations/20260908142748_CommitAlt.cs
@@ -0,0 +1,115 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace marlin.web.Migrations
+{
+    /// <inheritdoc />
+    public partial class CommitAlt : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "commit",
+                table: "jobs");
+
+            migrationBuilder.DropColumn(
+                name: "ref",
+                table: "jobs");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "branch_id",
+                table: "jobs",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<string>(
+                name: "claim_token",
+                table: "jobs",
+                type: "text",
+                nullable: true);
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "commit_id",
+                table: "jobs",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "ix_jobs_branch_id",
+                table: "jobs",
+                column: "branch_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_jobs_commit_id",
+                table: "jobs",
+                column: "commit_id");
+
+            migrationBuilder.AddForeignKey(
+                name: "fk_jobs_source_branches_branch_id",
+                table: "jobs",
+                column: "branch_id",
+                principalTable: "source_branches",
+                principalColumn: "id",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "fk_jobs_source_commits_commit_id",
+                table: "jobs",
+                column: "commit_id",
+                principalTable: "source_commits",
+                principalColumn: "id",
+                onDelete: ReferentialAction.Cascade);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "fk_jobs_source_branches_branch_id",
+                table: "jobs");
+
+            migrationBuilder.DropForeignKey(
+                name: "fk_jobs_source_commits_commit_id",
+                table: "jobs");
+
+            migrationBuilder.DropIndex(
+                name: "ix_jobs_branch_id",
+                table: "jobs");
+
+            migrationBuilder.DropIndex(
+                name: "ix_jobs_commit_id",
+                table: "jobs");
+
+            migrationBuilder.DropColumn(
+                name: "branch_id",
+                table: "jobs");
+
+            migrationBuilder.DropColumn(
+                name: "claim_token",
+                table: "jobs");
+
+            migrationBuilder.DropColumn(
+                name: "commit_id",
+                table: "jobs");
+
+            migrationBuilder.AddColumn<string>(
+                name: "commit",
+                table: "jobs",
+                type: "text",
+                nullable: false,
+                defaultValue: "");
+
+            migrationBuilder.AddColumn<string>(
+                name: "ref",
+                table: "jobs",
+                type: "text",
+                nullable: false,
+                defaultValue: "");
+        }
+    }
+}
diff --git a/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs b/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
index 8de35de..411706b 100644
--- a/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
+++ b/src/marlin.web/Migrations/ApplicationDbContextModelSnapshot.cs
@@ -22,13 +22,18 @@ namespace marlin.web.Migrations
 
             NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
 
-            modelBuilder.Entity("marlin.core.models.Agent", b =>
+            modelBuilder.Entity("marlin.web.Models.Agent", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("uuid")
                         .HasColumnName("id");
 
+                    b.Property<string>("AuthToken")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("auth_token");
+
                     b.Property<string>("Capabilities")
                         .IsRequired()
                         .HasColumnType("text")
@@ -53,7 +58,7 @@ namespace marlin.web.Migrations
                     b.ToTable("agents", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.Job", b =>
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -64,10 +69,17 @@ namespace marlin.web.Migrations
                         .HasColumnType("uuid")
                         .HasColumnName("agent_id");
 
-                    b.Property<string>("Commit")
-                        .IsRequired()
+                    b.Property<Guid>("BranchId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("branch_id");
+
+                    b.Property<string>("ClaimToken")
                         .HasColumnType("text")
-                        .HasColumnName("commit");
+                        .HasColumnName("claim_token");
+
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
 
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("timestamp with time zone")
@@ -83,11 +95,6 @@ namespace marlin.web.Migrations
                         .HasColumnType("text")
                         .HasColumnName("recipe");
 
-                    b.Property<string>("Ref")
-                        .IsRequired()
-                        .HasColumnType("text")
-                        .HasColumnName("ref");
-
                     b.Property<Guid>("SourceId")
                         .HasColumnType("uuid")
                         .HasColumnName("source_id");
@@ -102,13 +109,19 @@ namespace marlin.web.Migrations
                     b.HasIndex("AgentId")
                         .HasDatabaseName("ix_jobs_agent_id");
 
+                    b.HasIndex("BranchId")
+                        .HasDatabaseName("ix_jobs_branch_id");
+
+                    b.HasIndex("CommitId")
+                        .HasDatabaseName("ix_jobs_commit_id");
+
                     b.HasIndex("SourceId")
                         .HasDatabaseName("ix_jobs_source_id");
 
                     b.ToTable("jobs", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+            modelBuilder.Entity("marlin.web.Models.JobStatusUpdate", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -136,7 +149,45 @@ namespace marlin.web.Migrations
                     b.ToTable("job_status_update", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("content");
+
+                    b.Property<string>("Kind")
+                        .HasColumnType("text")
+                        .HasColumnName("kind");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("label");
+
+                    b.Property<bool>("MayReveal")
+                        .HasColumnType("boolean")
+                        .HasColumnName("may_reveal");
+
+                    b.Property<Guid>("SourceId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("source_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_secrets");
+
+                    b.HasIndex("SourceId")
+                        .HasDatabaseName("ix_secrets_source_id");
+
+                    b.ToTable("secrets", (string)null);
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlSource", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -172,7 +223,7 @@ namespace marlin.web.Migrations
                     b.ToTable("sources", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBlob", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -209,7 +260,7 @@ namespace marlin.web.Migrations
                     b.ToTable("source_blobs", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBranch", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -241,7 +292,7 @@ namespace marlin.web.Migrations
                     b.ToTable("source_branches", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
@@ -261,6 +312,10 @@ namespace marlin.web.Migrations
                         .HasColumnType("uuid")
                         .HasColumnName("source_id");
 
+                    b.Property<bool>("WorkflowScanned")
+                        .HasColumnType("boolean")
+                        .HasColumnName("workflow_scanned");
+
                     b.HasKey("Id")
                         .HasName("pk_source_commits");
 
@@ -270,52 +325,58 @@ namespace marlin.web.Migrations
                     b.ToTable("source_commits", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+            modelBuilder.Entity("marlin.web.Models.WorkflowSnapshot", b =>
                 {
                     b.Property<Guid>("Id")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("uuid")
                         .HasColumnName("id");
 
-                    b.Property<string>("Content")
-                        .IsRequired()
-                        .HasColumnType("text")
-                        .HasColumnName("content");
+                    b.Property<Guid>("CommitId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("commit_id");
 
-                    b.Property<string>("Kind")
-                        .HasColumnType("text")
-                        .HasColumnName("kind");
+                    b.Property<DateTime>("ScannedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("scanned_at");
 
-                    b.Property<string>("Label")
+                    b.Property<string>("Workflow")
                         .IsRequired()
                         .HasColumnType("text")
-                        .HasColumnName("label");
-
-                    b.Property<bool>("MayReveal")
-                        .HasColumnType("boolean")
-                        .HasColumnName("may_reveal");
-
-                    b.Property<Guid>("SourceId")
-                        .HasColumnType("uuid")
-                        .HasColumnName("source_id");
+                        .HasColumnName("workflow");
 
                     b.HasKey("Id")
-                        .HasName("pk_secrets");
+                        .HasName("pk_workflow_snapshots");
 
-                    b.HasIndex("SourceId")
-                        .HasDatabaseName("ix_secrets_source_id");
+                    b.HasIndex("CommitId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_workflow_snapshots_commit_id");
 
-                    b.ToTable("secrets", (string)null);
+                    b.ToTable("workflow_snapshots", (string)null);
                 });
 
-            modelBuilder.Entity("marlin.core.models.Job", b =>
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
                 {
-                    b.HasOne("marlin.core.models.Agent", "Agent")
-                        .WithMany()
+                    b.HasOne("marlin.web.Models.Agent", "Agent")
+                        .WithMany("Jobs")
                         .HasForeignKey("AgentId")
                         .HasConstraintName("fk_jobs_agents_agent_id");
 
-                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                    b.HasOne("marlin.web.Models.VersionControlledBranch", "Branch")
+                        .WithMany()
+                        .HasForeignKey("BranchId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_source_branches_branch_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithMany()
+                        .HasForeignKey("CommitId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_jobs_source_commits_commit_id");
+
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
                         .WithMany()
                         .HasForeignKey("SourceId")
                         .OnDelete(DeleteBehavior.Cascade)
@@ -324,12 +385,16 @@ namespace marlin.web.Migrations
 
                     b.Navigation("Agent");
 
+                    b.Navigation("Branch");
+
+                    b.Navigation("Commit");
+
                     b.Navigation("Source");
                 });
 
-            modelBuilder.Entity("marlin.core.models.JobStatusUpdate", b =>
+            modelBuilder.Entity("marlin.web.Models.JobStatusUpdate", b =>
                 {
-                    b.HasOne("marlin.core.models.Job", "Job")
+                    b.HasOne("marlin.web.Models.Job", "Job")
                         .WithMany("StatusUpdates")
                         .HasForeignKey("JobId")
                         .OnDelete(DeleteBehavior.Cascade)
@@ -339,16 +404,28 @@ namespace marlin.web.Migrations
                     b.Navigation("Job");
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledBlob", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
                 {
-                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
+                        .WithMany()
+                        .HasForeignKey("SourceId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_secrets_sources_source_id");
+
+                    b.Navigation("Source");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBlob", b =>
+                {
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
                         .WithMany("Blobs")
                         .HasForeignKey("CommitId")
                         .OnDelete(DeleteBehavior.Cascade)
                         .IsRequired()
                         .HasConstraintName("fk_source_blobs_source_commits_commit_id");
 
-                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
                         .WithMany()
                         .HasForeignKey("SourceId")
                         .OnDelete(DeleteBehavior.Cascade)
@@ -360,16 +437,16 @@ namespace marlin.web.Migrations
                     b.Navigation("Source");
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledBranch", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledBranch", b =>
                 {
-                    b.HasOne("marlin.core.models.VersionControlledCommit", "Commit")
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
                         .WithMany("Branches")
                         .HasForeignKey("CommitId")
                         .OnDelete(DeleteBehavior.Cascade)
                         .IsRequired()
                         .HasConstraintName("fk_source_branches_source_commits_commit_id");
 
-                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
                         .WithMany("Branches")
                         .HasForeignKey("SourceId")
                         .OnDelete(DeleteBehavior.Cascade)
@@ -381,9 +458,9 @@ namespace marlin.web.Migrations
                     b.Navigation("Source");
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
                 {
-                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
+                    b.HasOne("marlin.web.Models.VersionControlSource", "Source")
                         .WithMany()
                         .HasForeignKey("SourceId")
                         .OnDelete(DeleteBehavior.Cascade)
@@ -393,33 +470,40 @@ namespace marlin.web.Migrations
                     b.Navigation("Source");
                 });
 
-            modelBuilder.Entity("marlin.web.Models.VersionControlSecret", b =>
+            modelBuilder.Entity("marlin.web.Models.WorkflowSnapshot", b =>
                 {
-                    b.HasOne("marlin.core.models.VersionControlSource", "Source")
-                        .WithMany()
-                        .HasForeignKey("SourceId")
+                    b.HasOne("marlin.web.Models.VersionControlledCommit", "Commit")
+                        .WithOne("WorkflowSnapshot")
+                        .HasForeignKey("marlin.web.Models.WorkflowSnapshot", "CommitId")
                         .OnDelete(DeleteBehavior.Cascade)
                         .IsRequired()
-                        .HasConstraintName("fk_secrets_sources_source_id");
+                        .HasConstraintName("fk_workflow_snapshots_source_commits_commit_id");
 
-                    b.Navigation("Source");
+                    b.Navigation("Commit");
                 });
 
-            modelBuilder.Entity("marlin.core.models.Job", b =>
+            modelBuilder.Entity("marlin.web.Models.Agent", b =>
+                {
+                    b.Navigation("Jobs");
+                });
+
+            modelBuilder.Entity("marlin.web.Models.Job", b =>
                 {
                     b.Navigation("StatusUpdates");
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlSource", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlSource", b =>
                 {
                     b.Navigation("Branches");
                 });
 
-            modelBuilder.Entity("marlin.core.models.VersionControlledCommit", b =>
+            modelBuilder.Entity("marlin.web.Models.VersionControlledCommit", b =>
                 {
                     b.Navigation("Blobs");
 
                     b.Navigation("Branches");
+
+                    b.Navigation("WorkflowSnapshot");
                 });
 #pragma warning restore 612, 618
         }