fix(rollback): plan rollback from selected apply

[aparajon]

Summary

Rollback now starts from the apply the operator selected, instead of rediscovering whatever schema state happens to be newest on the PR. schemabot rollback <apply-id> validates that the apply belongs to the PR/database/environment, builds the rollback plan from that apply's stored original schema, and pins that rollback plan to the lock so rollback-confirm executes the plan the operator reviewed.

This keeps rollback deterministic when a PR has multiple applies, newer plans, or multi-database configuration. It also keeps unsafe cases fail-closed: older applies without captured original schema cannot be rolled back automatically, rollback plans cannot be consumed by apply-confirm, and Vitess VSchema rollback remains blocked until original VSchema capture is supported.

Generated with Amp

[Copilot]

Pull request overview

This PR updates rollback planning to be based on the requested apply’s captured pre-apply schema, routes rollback planning through the normal Plan flow so local and gRPC clients share behavior, and extends Tern plan responses to include the captured “original schema” for later rollback planning and remote plan storage.

Changes:

• Add original_schema to SchemaChange in the Tern proto and propagate it through LocalClient Plan responses and SchemaBot plan storage.
• Replace the prior client-level RollbackPlan flow with service-level rollback planning (ExecuteRollbackPlanForApply) that calls the standard Plan path and stores the resulting plan.
• Update webhook/API rollback handlers and tests to use apply-scoped rollback planning.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/webhook/rollback.go	Rollback plan generation now uses the requested apply; rollback-confirm re-plans via the service.
pkg/tern/local_control.go	Removes LocalClient RollbackPlan implementation (no longer needed).
pkg/tern/local_client.go	Attaches stored OriginalSchema to plan response schema changes.
pkg/tern/local_client_integration_test.go	Asserts OriginalSchema is present in Plan responses.
pkg/tern/grpc_client.go	Removes unsupported RollbackPlan method.
pkg/tern/client.go	Removes RollbackPlan from the tern.Client interface.
pkg/proto/tern.proto	Adds original_schema field to SchemaChange.
pkg/proto/ternv1/tern.pb.go	Regenerated protobuf bindings for original_schema.
pkg/proto/ternv1/tern_grpc.pb.go	Regenerated gRPC bindings (version bump).
pkg/api/rollback_plan_integration_test.go	Integration test ensuring rollback uses the requested apply’s original schema and stores rollback plan original schema.
pkg/api/proto_helpers.go	Persists SchemaChange.OriginalSchema into stored plan namespaces.
pkg/api/plan_handlers.go	Introduces ExecuteRollbackPlanForApply, factors out storePlanResponse, adds latest-completed-apply lookup.
pkg/api/handlers_test.go	Enhances mock Tern client to capture/return Plan requests/responses.
pkg/api/control_handlers.go	Rollback plan endpoint now plans from the requested apply (apply-scoped).

Files not reviewed (2)

• pkg/proto/ternv1/tern.pb.go: Language not supported
• pkg/proto/ternv1/tern_grpc.pb.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aparajon]

🤖 Note for whoever picks this up after #137: PR #137 does not obsolete this rollback PR. #137 only changes admin/control operations (cutover, stop, start, volume, revert, skip-revert) to require apply_id + environment and derive database/routing from storage.

This PR still owns rollback-specific behavior: building rollback plans from the requested apply's captured original schema, preventing fallback to the latest completed apply, requiring/validating the same apply ID through rollback-confirm, preserving original schema in Tern plan responses, and keeping the rollback webhook/integration coverage.

Expect a rebase/conflict cleanup with #137 in shared files like pkg/api/control_handlers.go, pkg/api/handlers_test.go, and TEMPLATES.md. A clearer post-rebase title might be fix(rollback): bind rollback to requested apply snapshot.