feat: register placements with engine and persist publisher_id

[trial-gravity]

Depends on: https://github.com/Try-Gravity/gravity/pull/88 (merge that first)

Summary

• When generate_code is called with a valid API key, the MCP server now POSTs to the engine's POST /api/v1/placements endpoint to register the placement, then stores the returned publisher_id in the local PostgreSQL alongside the existing placement data.
• Adds a publisher_id column to the local placements table with an ALTER TABLE migration for existing databases.
• Changes the INSERT from ON CONFLICT DO NOTHING to ON CONFLICT DO UPDATE so repeat calls backfill publisher_id and refresh placement type.

Details

mcp-server/data/db.py: Schema change -- adds publisher_id TEXT DEFAULT '' to CREATE TABLE, migration SQL, and INSERT. Upsert now updates publisher_id and placement on conflict.

mcp-server/tools/generate_code.py: Adds _register_placement() helper that calls the engine and extracts publisher_id from the response. Gracefully returns "" on any failure (timeout, network error, non-200). Wired into generate_code() before write_placement() so the publisher_id flows into the local DB row.

Test plan

• All 61 existing unit tests pass
• Verified engine endpoint returns publisher_id via direct curl
• Verified full MCP -> engine -> local DB flow with patched write_placement captures correct publisher_id
• Verified graceful fallback: when engine is unreachable, publisher_id is "" and no error surfaces to the caller

---

Note

Medium Risk
Adds an outbound HTTP call during generate_code and changes persistence semantics to an upsert with schema migration, which could affect runtime behavior on failures and existing DB rows.

Overview
When generate_code is called with an api_key, it now POSTs to the Gravity engine (/api/v1/placements) to register the placement and captures the returned publisher_id (falling back to "" on any error/timeout).

Local persistence is extended to store publisher_id: the placements table gains a new column with an ALTER TABLE migration, and the write path switches from insert-only to an upsert that backfills publisher_id (only overwriting when non-empty) and refreshes placement on conflicts. Unit tests are updated to mock the new outbound registration call.

^{Written by Cursor Bugbot for commit 5556182. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Upsert overwrites valid publisher_id with empty string
  • The upsert now preserves the existing placements.publisher_id unless the incoming EXCLUDED.publisher_id is non-empty, preventing valid IDs from being overwritten by empty strings.

Or push these changes by commenting:

@cursor push a53a332a4a

Preview (a53a332a4a)

diff --git a/mcp-server/data/db.py b/mcp-server/data/db.py
--- a/mcp-server/data/db.py
+++ b/mcp-server/data/db.py
@@ -35,7 +35,10 @@
 INSERT INTO placements (placement_id, placement, style, type, framework, platform, performance, publisher_key_hash, publisher_id, created_at)
 VALUES (%(placement_id)s, %(placement)s, %(style)s, %(type)s, %(framework)s, %(platform)s, %(performance)s, %(publisher_key_hash)s, %(publisher_id)s, %(created_at)s)
 ON CONFLICT (placement_id) DO UPDATE
-SET publisher_id = EXCLUDED.publisher_id,
+SET publisher_id = CASE
+        WHEN EXCLUDED.publisher_id <> '' THEN EXCLUDED.publisher_id
+        ELSE placements.publisher_id
+    END,
     placement = EXCLUDED.placement
 """

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Tests make unintended real HTTP calls to production
  • I updated the autouse test fixture to patch tools.generate_code._register_placement so tests with an API key no longer perform real outbound HTTP requests.
• ✅ Fixed: Strict 200 check silently drops 201 Created responses
  • I changed _register_placement to use resp.is_success so successful 2xx responses such as 201 now preserve and return publisher_id.

Or push these changes by commenting:

@cursor push 3e13a537b1

Preview (3e13a537b1)

diff --git a/mcp-server/tests/test_tools.py b/mcp-server/tests/test_tools.py
--- a/mcp-server/tests/test_tools.py
+++ b/mcp-server/tests/test_tools.py
@@ -16,8 +16,10 @@
 
 @pytest.fixture(autouse=True)
 def _mock_db():
-    """Prevent real DB writes during unit tests."""
-    with patch("tools.generate_code.write_placement"):
+    """Prevent real DB writes and network registration during unit tests."""
+    with patch("tools.generate_code.write_placement"), patch(
+        "tools.generate_code._register_placement", return_value=""
+    ):
         yield
 
 

diff --git a/mcp-server/tools/generate_code.py b/mcp-server/tools/generate_code.py
--- a/mcp-server/tools/generate_code.py
+++ b/mcp-server/tools/generate_code.py
@@ -27,7 +27,7 @@
             json={"placement_id": placement_id, "placement": placement},
             timeout=5.0,
         )
-        if resp.status_code == 200:
+        if resp.is_success:
             return resp.json().get("publisher_id", "")
     except Exception:
         logger.debug("Engine placement registration failed", exc_info=True)

[cursor]

Strict 200 check silently drops 201 Created responses

Low Severity

_register_placement only extracts publisher_id when resp.status_code == 200, but this is a POST endpoint that registers a new resource. The HTTP-standard response for resource creation is 201 Created. If the engine returns 201, the publisher_id is silently discarded and stored as "". This contrasts with validate_api_key in data/auth.py, which checks for known failure codes instead, making it resilient to any successful status code.