fix(migration): rewrite b035 with raw SQL to avoid SQLAlchemy DDL hook

SQLAlchemy fires before_create for ALL known enum types when any table
is created via op.create_table, causing DuplicateObject even with
create_type=False. Rewrite both CREATE TABLE statements as raw SQL via
conn.execute(sa.text(...)) and use CREATE TABLE IF NOT EXISTS / CREATE
INDEX IF NOT EXISTS for full idempotency.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/alembic/versions/b035_ownership_queue.py

@@ -3,12 +3,14 @@
 Revision ID: b035ownerq
 Revises: b034dlm
 Create Date: 2026-05-19
+
+Uses raw SQL for all DDL to avoid SQLAlchemy before_create hook issues
+with existing enum types.
 """
 
 from typing import Union
 from alembic import op
 import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
 
 revision: str = "b035ownerq"
 down_revision: Union[str, None] = "b034dlm"
@@ -16,96 +18,101 @@ branch_labels = None
 depends_on = None
 
 
-def _table_exists(table_name: str) -> bool:
-    conn = op.get_bind()
-    return conn.dialect.has_table(conn, table_name)
-
-
 def upgrade() -> None:
-    # ── Enums (idempotent via DO/EXCEPTION) ──────────────────────────────────
-    op.execute("""
+    conn = op.get_bind()
+
+    # ── Enums (idempotent) ────────────────────────────────────────────────────
+    conn.execute(sa.text("""
         DO $$ BEGIN
             CREATE TYPE queue_priority AS ENUM ('critical', 'high', 'medium', 'low');
         EXCEPTION WHEN duplicate_object THEN NULL;
-        END $$;
-    """)
-    op.execute("""
+        END $$
+    """))
+    conn.execute(sa.text("""
         DO $$ BEGIN
             CREATE TYPE queue_status AS ENUM ('pending', 'in_progress', 'completed', 'dismissed');
         EXCEPTION WHEN duplicate_object THEN NULL;
-        END $$;
-    """)
-    op.execute("""
+        END $$
+    """))
+    conn.execute(sa.text("""
         DO $$ BEGIN
             CREATE TYPE queue_reason AS ENUM (
                 'validation_expired', 'infra_change', 'osint_alert',
                 'mitre_update', 'rule_modified', 'low_confidence', 'manual');
         EXCEPTION WHEN duplicate_object THEN NULL;
-        END $$;
-    """)
+        END $$
+    """))
 
-    # ── technique_ownerships ─────────────────────────────────────────────────
-    if not _table_exists("technique_ownerships"):
-        op.create_table(
-            "technique_ownerships",
-            sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-            sa.Column("technique_id", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("techniques.id", ondelete="CASCADE"), nullable=False, unique=True),
-            sa.Column("owner_id", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
-            sa.Column("backup_owner_id", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
-            sa.Column("team", sa.String(200), nullable=True),
-            sa.Column("notes", sa.Text, nullable=True),
-            sa.Column("assigned_at", sa.DateTime, nullable=True),
-            sa.Column("assigned_by", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
-            sa.Column("created_at", sa.DateTime, server_default=sa.func.now()),
-            sa.Column("updated_at", sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now()),
+    # ── technique_ownerships ──────────────────────────────────────────────────
+    conn.execute(sa.text("""
+        CREATE TABLE IF NOT EXISTS technique_ownerships (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            technique_id UUID NOT NULL UNIQUE
+                REFERENCES techniques(id) ON DELETE CASCADE,
+            owner_id UUID
+                REFERENCES users(id) ON DELETE SET NULL,
+            backup_owner_id UUID
+                REFERENCES users(id) ON DELETE SET NULL,
+            team VARCHAR(200),
+            notes TEXT,
+            assigned_at TIMESTAMP,
+            assigned_by UUID
+                REFERENCES users(id) ON DELETE SET NULL,
+            created_at TIMESTAMP DEFAULT now(),
+            updated_at TIMESTAMP DEFAULT now()
         )
-        op.create_index("ix_techown_owner_id", "technique_ownerships", ["owner_id"])
-        op.create_index("ix_techown_technique_id", "technique_ownerships", ["technique_id"])
+    """))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_techown_owner_id ON technique_ownerships (owner_id)"
+    ))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_techown_technique_id ON technique_ownerships (technique_id)"
+    ))
 
     # ── revalidation_queue_items ──────────────────────────────────────────────
-    if not _table_exists("revalidation_queue_items"):
-        op.create_table(
-            "revalidation_queue_items",
-            sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-            sa.Column("technique_id", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("techniques.id", ondelete="CASCADE"), nullable=True),
-            sa.Column("detection_asset_id", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("detection_assets.id", ondelete="CASCADE"), nullable=True),
-            sa.Column("priority", sa.Enum("critical", "high", "medium", "low",
-                                          name="queue_priority", create_type=False),
-                      nullable=False, server_default="medium"),
-            sa.Column("reason", sa.Enum("validation_expired", "infra_change", "osint_alert",
-                                        "mitre_update", "rule_modified", "low_confidence", "manual",
-                                        name="queue_reason", create_type=False),
-                      nullable=False),
-            sa.Column("reason_detail", sa.Text, nullable=True),
-            sa.Column("status", sa.Enum("pending", "in_progress", "completed", "dismissed",
-                                        name="queue_status", create_type=False),
-                      nullable=False, server_default="pending"),
-            sa.Column("assigned_to", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
-            sa.Column("due_date", sa.DateTime, nullable=True),
-            sa.Column("created_at", sa.DateTime, server_default=sa.func.now()),
-            sa.Column("completed_at", sa.DateTime, nullable=True),
-            sa.Column("dismissed_at", sa.DateTime, nullable=True),
-            sa.Column("completed_by", postgresql.UUID(as_uuid=True),
-                      sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
-            sa.Column("extra", postgresql.JSONB, nullable=True),
+    conn.execute(sa.text("""
+        CREATE TABLE IF NOT EXISTS revalidation_queue_items (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            technique_id UUID
+                REFERENCES techniques(id) ON DELETE CASCADE,
+            detection_asset_id UUID
+                REFERENCES detection_assets(id) ON DELETE CASCADE,
+            priority queue_priority NOT NULL DEFAULT 'medium',
+            reason queue_reason NOT NULL,
+            reason_detail TEXT,
+            status queue_status NOT NULL DEFAULT 'pending',
+            assigned_to UUID
+                REFERENCES users(id) ON DELETE SET NULL,
+            due_date TIMESTAMP,
+            created_at TIMESTAMP DEFAULT now(),
+            completed_at TIMESTAMP,
+            dismissed_at TIMESTAMP,
+            completed_by UUID
+                REFERENCES users(id) ON DELETE SET NULL,
+            extra JSONB
         )
-        op.create_index("ix_rqueue_status", "revalidation_queue_items", ["status"])
-        op.create_index("ix_rqueue_priority", "revalidation_queue_items", ["priority"])
-        op.create_index("ix_rqueue_assigned_to", "revalidation_queue_items", ["assigned_to"])
-        op.create_index("ix_rqueue_technique_id", "revalidation_queue_items", ["technique_id"])
-        op.create_index("ix_rqueue_asset_id", "revalidation_queue_items", ["detection_asset_id"])
+    """))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_rqueue_status ON revalidation_queue_items (status)"
+    ))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_rqueue_priority ON revalidation_queue_items (priority)"
+    ))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_rqueue_assigned_to ON revalidation_queue_items (assigned_to)"
+    ))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_rqueue_technique_id ON revalidation_queue_items (technique_id)"
+    ))
+    conn.execute(sa.text(
+        "CREATE INDEX IF NOT EXISTS ix_rqueue_asset_id ON revalidation_queue_items (detection_asset_id)"
+    ))
 
 
 def downgrade() -> None:
-    op.drop_table("revalidation_queue_items")
-    op.drop_table("technique_ownerships")
-    op.execute("DROP TYPE IF EXISTS queue_reason")
-    op.execute("DROP TYPE IF EXISTS queue_status")
-    op.execute("DROP TYPE IF EXISTS queue_priority")
+    conn = op.get_bind()
+    conn.execute(sa.text("DROP TABLE IF EXISTS revalidation_queue_items"))
+    conn.execute(sa.text("DROP TABLE IF EXISTS technique_ownerships"))
+    conn.execute(sa.text("DROP TYPE IF EXISTS queue_reason"))
+    conn.execute(sa.text("DROP TYPE IF EXISTS queue_status"))
+    conn.execute(sa.text("DROP TYPE IF EXISTS queue_priority"))