Migrate runs into the beamline/proposal/session tree

[ZohebShaikh]

Moves runs from the flat catalog root into root/<beamline>/<proposal>/<session>/<run>, the layout blueapi now writes into, and updates the policy so it can read the tags on those nodes.

Policy (src/dls_tiled/policy.py)

• DiamondAccessBlob now accepts beamline-only and beamline+proposal blobs (for creating container nodes); proposal is the full code, e.g. cm12345.
• Tags that aren't a JSON blob are parsed as composite tags (beamline:i22,proposal:12345,session:12345-1) instead of raising.

Migration (database_migration/)

• migrate_node_structure.py: upgrades the tiled schema, then moves each root run under new containers carrying the same tags tiled.rego stamps, and retags everything under it with its session tag. Runs it can't place are left and listed. Has --dry-run; safe to rerun. Both scripts carry their dependencies inline: uv run --script migrate_node_structure.py ... (tiled pinned to the runtime image's 0.2.18).
• postgres_tools.py: read-only role creation and backup.
• README.md: the full runbook, including restore. Restore steps say to scale tiled to zero first, otherwise it creates the schema in the empty database and pg_restore fails.
• test_integration.py + integration/: seeds a catalog (or restores a production dump with PROD_DUMP), migrates it, and reads it back through dls-tiled with real Keycloak tokens and OPA.

Before running against prod

Prod's alembic_version is 4cf6011a8db5, but its schema already has the webhooks tables, ix_nodes_parent_id and the ragged enum value (head, e8956581ecd5). tiled catalog upgrade-database therefore fails with relation "webhooks" already exists. Stamp it first:

UPDATE alembic_version SET version_num = 'e8956581ecd5' WHERE version_num = '4cf6011a8db5';

Testing

• tests/test_policy.py and test_migrate_node_structure.py pass (37 tests).
• test_integration.py runs in CI (new migration job): without PROD_DUMP it seeds a small catalog in the old flat layout, migrates it, and reads it back through the compose stack. Passes locally with docker (4 tests).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.38%. Comparing base (c1dcb1e) to head (5a39180).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #22      +/-   ##
==========================================
+ Coverage   95.16%   95.38%   +0.21%     
==========================================
  Files           5        5              
  Lines         766      801      +35     
==========================================
+ Hits          729      764      +35     
  Misses         37       37              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.