@aeolus-fleet/core 0.27.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeolus-fleet/core",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "The Aeolus fleet server: ships, guaranteed delivery and the API for Claude Code, Codex and any agent.",
   "keywords": [
     "ai-agents",
@@ -23,9 +23,16 @@
   },
   "exports": {
     ".": {
-      "@aeolus-fleet/source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    },
+    "./testing/postgres-global-setup": {
+      "types": "./dist/testing/postgres-global-setup.d.ts",
+      "default": "./dist/testing/postgres-global-setup.js"
     }
   },
   "bin": {
@@ -51,7 +58,7 @@
     "postpack": "rm LICENSE"
   },
   "dependencies": {
-    "@aeolus-fleet/common": "0.27.0",
+    "@aeolus-fleet/common": "0.28.0",
     "@fastify/websocket": "^11.3.1",
     "@modelcontextprotocol/server": "^2.3.0",
     "@prisma/adapter-pg": "^7.10.0",
@@ -63,6 +70,22 @@
     "prisma": "^7.10.0",
     "zod": "^4.6.5"
   },
+  "peerDependencies": {
+    "@testcontainers/postgresql": "^12.2.0",
+    "testcontainers": "^12.2.0",
+    "vitest": "^5.0.3"
+  },
+  "peerDependenciesMeta": {
+    "@testcontainers/postgresql": {
+      "optional": true
+    },
+    "testcontainers": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.2.0",
     "@testcontainers/postgresql": "^12.2.0",

package/src/adapters/prisma/migrations/20261018250000_scope_catalogue/migration.sql

@@ -10,8 +10,9 @@ CREATE OR REPLACE FUNCTION "ships_scopes_are_known"("scopes" TEXT[]) RETURNS BOO
 $$;
 
 -- Each holder keeps what it did within the new bounds: every active ship holding fleet:manage also gets
--- fleet:commission and messages:resend, and each active plugin ship, by its type, holds exactly its set,
--- losing what the set leaves out. Scopes stay in catalogue order, a plugin's own after them. Every ship it
+-- fleet:commission and messages:resend, and each active plugin ship holds exactly its set, losing what the
+-- set leaves out. A plugin's ship is known by its name and type together, as the console connects it: types
+-- are not reserved, so another ship of that type keeps what it holds. Scopes stay in catalogue order, a plugin's own after them. Every ship it
 -- changes gets one ScopesChanged, by the system, naming what it added and took away, at the next number of
 -- its fleet's stream, with an evt_ id as common/src/ids makes them (the time in milliseconds, then 80 random
 -- bits, in lowercase Crockford base32).
@@ -29,14 +30,14 @@ DECLARE
   next_seq bigint;
 BEGIN
   FOR ship IN
-    SELECT "id", "fleet_id", "type", "scopes" FROM "ships"
-    WHERE "retired_at" IS NULL AND ("type" IN ('squadrons', 'trierarch-plugin') OR 'fleet:manage' = ANY("scopes"))
+    SELECT "id", "fleet_id", "name", "type", "scopes" FROM "ships"
+    WHERE "retired_at" IS NULL AND ("name" = "type" AND "type" IN ('squadrons', 'trierarch-plugin') OR 'fleet:manage' = ANY("scopes"))
     ORDER BY "fleet_id", "id"
     FOR UPDATE
   LOOP
-    wanted := CASE ship."type"
-      WHEN 'squadrons' THEN ARRAY['messages:send', 'messages:receive', 'fleet:read', 'fleet:commission', 'fleet:manage', 'labels:define', 'labels:assign', 'scopes:declare']
-      WHEN 'trierarch-plugin' THEN ARRAY['messages:send', 'messages:receive', 'fleet:read', 'fleet:commission', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign']
+    wanted := CASE ship."name" || '/' || ship."type"
+      WHEN 'squadrons/squadrons' THEN ARRAY['messages:send', 'messages:receive', 'fleet:read', 'fleet:commission', 'fleet:manage', 'labels:define', 'labels:assign', 'scopes:declare']
+      WHEN 'trierarch-plugin/trierarch-plugin' THEN ARRAY['messages:send', 'messages:receive', 'fleet:read', 'fleet:commission', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign']
       ELSE ship."scopes" || ARRAY['fleet:commission', 'messages:resend']
     END;
     SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "first_at") INTO wanted

package/src/adapters/prisma/migrations/20261019100000_on_behalf_scope/migration.sql

@@ -11,6 +11,8 @@ $$;
 
 -- argo holds every scope, and squadrons reads on behalf of a person's ship (decision 0017): every argo and every
 -- active squadrons ship gets fleet:on-behalf, its scopes kept in catalogue order, a plugin's own after them.
+-- Squadrons' ship is known by its name and type together, as the console connects it: types are not reserved,
+-- so another ship of type squadrons keeps what it holds.
 -- Every state change writes its event: each ship it changes gets
 -- ScopesChanged, by the system, taking the next number of its fleet's stream. Its id is an evt_ id as
 -- common/src/ids makes them: the time in milliseconds, then 80 random bits, in lowercase Crockford base32.
@@ -29,7 +31,7 @@ BEGIN
       SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "place")
       FROM unnest(array_append("ships"."scopes", 'fleet:on-behalf')) WITH ORDINALITY AS u("scope", "place")
     )
-    WHERE ("kind" = 'operator' OR "type" = 'squadrons') AND "retired_at" IS NULL AND NOT ('fleet:on-behalf' = ANY("scopes"))
+    WHERE ("kind" = 'operator' OR ("name" = 'squadrons' AND "type" = 'squadrons')) AND "retired_at" IS NULL AND NOT ('fleet:on-behalf' = ANY("scopes"))
     RETURNING "fleet_id", "id"
   LOOP
     at := clock_timestamp();

package/src/adapters/prisma/migrations/20261019130000_plugin_connections/migration.sql

@@ -0,0 +1,54 @@
+-- A plugin argo connected (decision 0034): its ship reads every ship of the fleet, whatever the rules, until a
+-- release or a retire of the ship ends it.
+-- CreateTable
+CREATE TABLE "plugin_connections" (
+    "fleet_id" TEXT NOT NULL,
+    "ship_id" TEXT NOT NULL,
+    "connected_at" TIMESTAMPTZ(3) NOT NULL,
+
+    CONSTRAINT "plugin_connections_pkey" PRIMARY KEY ("fleet_id","ship_id")
+);
+
+-- AddForeignKey
+ALTER TABLE "plugin_connections" ADD CONSTRAINT "plugin_connections_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "plugin_connections" ADD CONSTRAINT "plugin_connections_fleet_id_ship_id_fkey" FOREIGN KEY ("fleet_id", "ship_id") REFERENCES "ships"("fleet_id", "id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- The plugins argo connected before: every active ship the console connects a plugin as, known by its name and type
+-- together (squadrons, the trierarch plugin, the networking plugin), is connected now. Each gets PluginConnected, by
+-- the system, at the next number of its fleet's stream, with an evt_ id as common/src/ids makes them (the time in
+-- milliseconds, then 80 random bits, in lowercase Crockford base32).
+DO $$
+DECLARE
+  alphabet CONSTANT text := '0123456789abcdefghjkmnpqrstvwxyz';
+  plugin record;
+  at timestamptz;
+  millis bigint;
+  body text;
+  next_seq bigint;
+BEGIN
+  FOR plugin IN
+    SELECT "id", "fleet_id" FROM "ships"
+    WHERE "retired_at" IS NULL AND "name" = "type" AND "type" IN ('squadrons', 'trierarch-plugin', 'networking-plugin')
+    ORDER BY "fleet_id", "id"
+  LOOP
+    at := clock_timestamp();
+    INSERT INTO "plugin_connections" ("fleet_id", "ship_id", "connected_at") VALUES (plugin."fleet_id", plugin."id", at);
+
+    millis := floor(extract(epoch FROM at) * 1000)::bigint;
+    body := '';
+    FOR position IN REVERSE 9..0 LOOP
+      body := body || substr(alphabet, ((millis >> (position * 5)) & 31)::integer + 1, 1);
+    END LOOP;
+    FOR position IN 1..16 LOOP
+      body := body || substr(alphabet, floor(random() * 32)::integer + 1, 1);
+    END LOOP;
+
+    UPDATE "fleets" SET "last_event_seq" = "last_event_seq" + 1 WHERE "id" = plugin."fleet_id"
+      RETURNING "last_event_seq" INTO next_seq;
+    INSERT INTO "events" ("id", "fleet_id", "type", "occurred_at", "ship_id", "details", "seq")
+    VALUES ('evt_' || body, plugin."fleet_id", 'PluginConnected', at, plugin."id", '{}'::jsonb, next_seq);
+  END LOOP;
+END;
+$$;

package/src/adapters/prisma/migrations/20261019150000_network_plugin_registered_at/migration.sql

@@ -0,0 +1,23 @@
+-- When the fleet's networking plugin first registered (decision 0035), set
+-- with its ship and declaration, all four or none. A plugin registered before
+-- this column takes the time of its first NetworkPluginRegistered event since
+-- the fleet's latest NetworkPluginUnregistered (a retirement writes one too).
+ALTER TABLE "network_settings" ADD COLUMN "plugin_registered_at" TIMESTAMPTZ(3);
+
+UPDATE "network_settings" AS s
+SET "plugin_registered_at" = COALESCE(
+    (SELECT min(e."occurred_at") FROM "events" e
+     WHERE e."fleet_id" = s."fleet_id" AND e."type" = 'NetworkPluginRegistered' AND e."ship_id" = s."plugin_ship_id"
+       AND e."occurred_at" > COALESCE(
+           (SELECT max(u."occurred_at") FROM "events" u WHERE u."fleet_id" = s."fleet_id" AND u."type" = 'NetworkPluginUnregistered'),
+           '-infinity')),
+    now())
+WHERE s."plugin_ship_id" IS NOT NULL;
+
+ALTER TABLE "network_settings"
+    DROP CONSTRAINT "network_settings_plugin_whole",
+    ADD CONSTRAINT "network_settings_plugin_whole" CHECK (
+        ("plugin_ship_id" IS NULL) = ("plugin_while_unavailable" IS NULL)
+        AND ("plugin_ship_id" IS NULL) = ("plugin_not_responding_after_seconds" IS NULL)
+        AND ("plugin_ship_id" IS NULL) = ("plugin_registered_at" IS NULL)
+    );

package/src/adapters/prisma/migrations/20261019160000_lease_waker/migration.sql

@@ -0,0 +1,4 @@
+-- What wakes a pushed ship, as its first push receive states it (interop 5.1).
+CREATE TYPE "lease_waker" AS ENUM ('trierarch', 'pluginWatcher', 'personApp', 'gateway', 'adapter');
+
+ALTER TABLE "leases" ADD COLUMN "waker" "lease_waker";

package/src/adapters/prisma/migrations/20261019200000_account_cut_offs/migration.sql

@@ -0,0 +1,10 @@
+-- The accounts pagasae cut off, kept until their last token has ended (decision 0058).
+CREATE TABLE "account_cut_offs" (
+    "account_id" TEXT NOT NULL,
+    "cut_off_at" TIMESTAMPTZ(3) NOT NULL,
+    "forget_at" TIMESTAMPTZ(3) NOT NULL,
+
+    CONSTRAINT "account_cut_offs_pkey" PRIMARY KEY ("account_id")
+);
+
+CREATE INDEX "account_cut_offs_forget_at_idx" ON "account_cut_offs"("forget_at");

package/src/adapters/prisma/migrations/20261019210000_event_actors/migration.sql

@@ -0,0 +1,32 @@
+-- Every event names its actor (decision 0057): a ship, an account by its id
+-- only with the ship it came through, the installation, or the system.
+CREATE TYPE "event_actor_kind" AS ENUM ('ship', 'account', 'installation', 'system');
+
+ALTER TABLE "events" ADD COLUMN "actor_kind" "event_actor_kind",
+ADD COLUMN "actor_account_id" TEXT,
+ADD COLUMN "actor_through_ship_id" TEXT;
+
+-- Naming the actor of the events already written, a ship or the system, is
+-- the one exception to append-only events, so the guard is off for this
+-- statement alone.
+ALTER TABLE "events" DISABLE TRIGGER "events_append_only";
+
+UPDATE "events" SET "actor_kind" = CASE WHEN "actor_ship_id" IS NULL THEN 'system'::"event_actor_kind" ELSE 'ship'::"event_actor_kind" END;
+
+ALTER TABLE "events" ENABLE TRIGGER "events_append_only";
+
+-- An event that names no actor is the system's, as every migration that writes events writes them.
+ALTER TABLE "events" ALTER COLUMN "actor_kind" SET NOT NULL, ALTER COLUMN "actor_kind" SET DEFAULT 'system';
+
+-- A ship actor has its ship, an account its id and maybe the ship it came through, the others neither.
+ALTER TABLE "events" ADD CONSTRAINT "events_actor_named" CHECK (
+  ("actor_ship_id" IS NOT NULL) = ("actor_kind" = 'ship')
+  AND ("actor_account_id" IS NOT NULL) = ("actor_kind" = 'account')
+  AND ("actor_through_ship_id" IS NULL OR "actor_kind" = 'account')
+);
+
+-- Led by the ship, not the fleet: almost every row has none, and an index led
+-- by the fleet would tempt the planner off (fleet_id, occurred_at).
+CREATE INDEX "events_actor_through_ship_id_fleet_id_idx" ON "events"("actor_through_ship_id", "fleet_id");
+
+ALTER TABLE "events" ADD CONSTRAINT "events_fleet_id_actor_through_ship_id_fkey" FOREIGN KEY ("fleet_id", "actor_through_ship_id") REFERENCES "ships"("fleet_id", "id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020090000_argos_jobs_as_scopes/migration.sql

@@ -0,0 +1,65 @@
+-- The jobs that were argo's alone become scopes any actor can be granted (decision 0053): fleet:person,
+-- fleet:owner, fleet:explain, fleet:connect and labels:any join the core scopes (decision 0046).
+CREATE OR REPLACE FUNCTION "ships_scopes_are_known"("scopes" TEXT[]) RETURNS BOOLEAN IMMUTABLE LANGUAGE SQL AS $$
+  SELECT "scopes" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM unnest("scopes") AS "scope"
+    WHERE NOT (
+      "scope" = ANY(ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'scopes:declare', 'scopes:grant']::TEXT[])
+      OR ("scope" ~ '^[a-z][a-z0-9-]{0,31}:[a-z][a-z0-9-]{0,31}$' AND split_part("scope", ':', 1) <> ALL(ARRAY['messages', 'fleet', 'crew', 'labels', 'scopes']::TEXT[]))
+    )
+  )
+$$;
+
+-- argo holds every scope: every argo gets the five, its scopes kept in catalogue order, a plugin's own after
+-- them. Every state change writes its event: each argo it changes gets ScopesChanged, by the system, taking
+-- the next number of its fleet's stream. Its id is an evt_ id as common/src/ids makes them: the time in
+-- milliseconds, then 80 random bits, in lowercase Crockford base32.
+DO $$
+DECLARE
+  alphabet CONSTANT text := '0123456789abcdefghjkmnpqrstvwxyz';
+  catalogue CONSTANT text[] := ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'scopes:declare', 'scopes:grant'];
+  jobs CONSTANT text[] := ARRAY['fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any'];
+  changed record;
+  at timestamptz;
+  millis bigint;
+  body text;
+  next_seq bigint;
+BEGIN
+  FOR changed IN
+    WITH "before" AS (
+      SELECT "id", "scopes" FROM "ships" WHERE "kind" = 'operator' AND NOT ("scopes" @> jobs) FOR UPDATE
+    )
+    UPDATE "ships" SET "scopes" = (
+      SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "place")
+      FROM unnest("ships"."scopes" || ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("ships"."scopes")))) WITH ORDINALITY AS u("scope", "place")
+    )
+    FROM "before"
+    WHERE "ships"."id" = "before"."id"
+    RETURNING "ships"."fleet_id", "ships"."id",
+      array_to_string(ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("before"."scopes"))), ' ') AS "added"
+  LOOP
+    at := clock_timestamp();
+    millis := floor(extract(epoch FROM at) * 1000)::bigint;
+    body := '';
+    FOR position IN REVERSE 9..0 LOOP
+      body := body || substr(alphabet, ((millis >> (position * 5)) & 31)::integer + 1, 1);
+    END LOOP;
+    FOR position IN 1..16 LOOP
+      body := body || substr(alphabet, floor(random() * 32)::integer + 1, 1);
+    END LOOP;
+
+    UPDATE "fleets" SET "last_event_seq" = "last_event_seq" + 1 WHERE "id" = changed."fleet_id"
+      RETURNING "last_event_seq" INTO next_seq;
+    INSERT INTO "events" ("id", "fleet_id", "type", "occurred_at", "ship_id", "details", "seq")
+    VALUES (
+      'evt_' || body,
+      changed."fleet_id",
+      'ScopesChanged',
+      at,
+      changed."id",
+      jsonb_build_object('added', changed."added", 'removed', ''),
+      next_seq
+    );
+  END LOOP;
+END;
+$$;

package/src/adapters/prisma/migrations/20261020100000_installation_labels/migration.sql

@@ -0,0 +1,7 @@
+-- A label belongs to the actor that defined it: a ship, or the installation (decision 0031), which defines
+-- the label group in each fleet (decision 0052). An installation's label names no owner ship.
+CREATE TYPE "label_owner_kind" AS ENUM ('ship', 'installation');
+
+ALTER TABLE "labels" ADD COLUMN "owner_kind" "label_owner_kind" NOT NULL DEFAULT 'ship';
+ALTER TABLE "labels" ALTER COLUMN "owner_ship_id" DROP NOT NULL;
+ALTER TABLE "labels" ADD CONSTRAINT "labels_owner_named" CHECK (("owner_ship_id" IS NOT NULL) = ("owner_kind" = 'ship'));

package/src/adapters/prisma/migrations/20261020110000_installation_declared_network_rules/migration.sql

@@ -0,0 +1,10 @@
+-- The network rules the installation declares on the labels it owns, such as group=# to group=# (decisions 0037, 0052):
+-- one row per fleet while it declares any, apart from the ships' declared rules, as it is no ship.
+CREATE TABLE "installation_declared_network_rules" (
+    "fleet_id" TEXT NOT NULL,
+    "rules" JSONB NOT NULL,
+
+    CONSTRAINT "installation_declared_network_rules_pkey" PRIMARY KEY ("fleet_id")
+);
+
+ALTER TABLE "installation_declared_network_rules" ADD CONSTRAINT "installation_declared_network_rules_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020120000_commissioning_actors/migration.sql

@@ -0,0 +1,14 @@
+-- A ship is commissioned by an actor (decisions 0053, 0057): a ship, an account by its id only, or the installation,
+-- which commissions person ships. commissioned_by names it: the ship's id, the account's id, or 'installation'.
+-- Every commission so far was a ship's. An idempotency key is used once per commissioning actor.
+CREATE TYPE "commissioner_kind" AS ENUM ('ship', 'account', 'installation');
+
+ALTER TABLE "ships" ADD COLUMN "commissioned_by_kind" "commissioner_kind";
+UPDATE "ships" SET "commissioned_by_kind" = 'ship' WHERE "commissioned_by" IS NOT NULL;
+ALTER TABLE "ships" ADD CONSTRAINT "ships_commissioner_named" CHECK (
+  ("commissioned_by" IS NULL) = ("commissioned_by_kind" IS NULL)
+  AND ("commissioned_by_kind" <> 'installation' OR "commissioned_by" = 'installation')
+);
+
+DROP INDEX "ships_fleet_id_commissioned_by_commission_key_key";
+CREATE UNIQUE INDEX "ships_commission_key_key" ON "ships"("fleet_id", "commissioned_by_kind", "commissioned_by", "commission_key");

package/src/adapters/prisma/migrations/20261020130000_console_sign_in_accounts/migration.sql

@@ -0,0 +1,4 @@
+-- A sign-in ticket from pagasae may name the account it signs in as argo, by its id only, never its email
+-- (decisions 0054, 0058); the console session it starts keeps that id. Null for argo's own sign-in and a viewer.
+ALTER TABLE "sign_in_tickets" ADD COLUMN "account_id" TEXT;
+ALTER TABLE "console_sessions" ADD COLUMN "account_id" TEXT;

package/src/adapters/prisma/migrations/20261020140000_event_signed_in_accounts/migration.sql

@@ -0,0 +1,4 @@
+-- An event argo writes names the account signed in to the console as it, by its id only (decision 0054).
+-- Earlier events name none.
+ALTER TABLE "events" ADD COLUMN "actor_signed_in_account_id" TEXT;
+ALTER TABLE "events" ADD CONSTRAINT "events_signed_in_account_by_a_ship" CHECK ("actor_signed_in_account_id" IS NULL OR "actor_kind" = 'ship');

package/src/adapters/prisma/migrations/20261020150000_account_cut_off_ends_console_sessions/migration.sql

@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "console_session_end_reason" ADD VALUE 'accountCutOff';

package/src/adapters/prisma/migrations/20261020160000_network_in_core/migration.sql

@@ -0,0 +1,30 @@
+-- Network rules live in core (decision 0034): the networking plugin goes.
+-- A fleet's own rules are a list, or NULL while none are applied: all-to-all,
+-- open on. A fleet whose open was on for send had no rules in force beside
+-- the built-in ones, so it keeps none; any other keeps its list.
+UPDATE "network_settings" SET "rules" = NULL WHERE "built_in_open_send";
+ALTER TABLE "network_settings" ALTER COLUMN "rules" DROP NOT NULL, ALTER COLUMN "rules" DROP DEFAULT;
+
+ALTER TABLE "network_settings"
+  DROP CONSTRAINT IF EXISTS "network_settings_plugin_whole",
+  DROP COLUMN "built_in_open_send",
+  DROP COLUMN "built_in_open_read",
+  DROP COLUMN "built_in_open_manage",
+  DROP COLUMN "plugin_ship_id",
+  DROP COLUMN "plugin_while_unavailable",
+  DROP COLUMN "plugin_not_responding_after_seconds",
+  DROP COLUMN "plugin_registered_at";
+
+ALTER TABLE "reach_refusals" DROP COLUMN "while_plugin_unavailable";
+
+-- The draft of a fleet's own rules: one a fleet at most, never in force.
+CREATE TABLE "network_rules_drafts" (
+    "fleet_id" TEXT NOT NULL,
+    "rules" JSONB,
+    "saved_at" TIMESTAMPTZ(3) NOT NULL,
+    "saved_against_version" INTEGER NOT NULL,
+
+    CONSTRAINT "network_rules_drafts_pkey" PRIMARY KEY ("fleet_id")
+);
+
+ALTER TABLE "network_rules_drafts" ADD CONSTRAINT "network_rules_drafts_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020170000_verify_scope/migration.sql

@@ -0,0 +1,64 @@
+-- fleet:verify, writing verified facts about the ships an actor manages, joins the core scopes (decisions 0046, 0059).
+CREATE OR REPLACE FUNCTION "ships_scopes_are_known"("scopes" TEXT[]) RETURNS BOOLEAN IMMUTABLE LANGUAGE SQL AS $$
+  SELECT "scopes" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM unnest("scopes") AS "scope"
+    WHERE NOT (
+      "scope" = ANY(ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'fleet:verify', 'scopes:declare', 'scopes:grant']::TEXT[])
+      OR ("scope" ~ '^[a-z][a-z0-9-]{0,31}:[a-z][a-z0-9-]{0,31}$' AND split_part("scope", ':', 1) <> ALL(ARRAY['messages', 'fleet', 'crew', 'labels', 'scopes']::TEXT[]))
+    )
+  )
+$$;
+
+-- argo holds every scope: every argo gets fleet:verify, its scopes kept in catalogue order, a plugin's own after
+-- them. Every state change writes its event: each argo it changes gets ScopesChanged, by the system, taking
+-- the next number of its fleet's stream. Its id is an evt_ id as common/src/ids makes them: the time in
+-- milliseconds, then 80 random bits, in lowercase Crockford base32.
+DO $$
+DECLARE
+  alphabet CONSTANT text := '0123456789abcdefghjkmnpqrstvwxyz';
+  catalogue CONSTANT text[] := ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'fleet:verify', 'scopes:declare', 'scopes:grant'];
+  jobs CONSTANT text[] := ARRAY['fleet:verify'];
+  changed record;
+  at timestamptz;
+  millis bigint;
+  body text;
+  next_seq bigint;
+BEGIN
+  FOR changed IN
+    WITH "before" AS (
+      SELECT "id", "scopes" FROM "ships" WHERE "kind" = 'operator' AND NOT ("scopes" @> jobs) FOR UPDATE
+    )
+    UPDATE "ships" SET "scopes" = (
+      SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "place")
+      FROM unnest("ships"."scopes" || ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("ships"."scopes")))) WITH ORDINALITY AS u("scope", "place")
+    )
+    FROM "before"
+    WHERE "ships"."id" = "before"."id"
+    RETURNING "ships"."fleet_id", "ships"."id",
+      array_to_string(ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("before"."scopes"))), ' ') AS "added"
+  LOOP
+    at := clock_timestamp();
+    millis := floor(extract(epoch FROM at) * 1000)::bigint;
+    body := '';
+    FOR position IN REVERSE 9..0 LOOP
+      body := body || substr(alphabet, ((millis >> (position * 5)) & 31)::integer + 1, 1);
+    END LOOP;
+    FOR position IN 1..16 LOOP
+      body := body || substr(alphabet, floor(random() * 32)::integer + 1, 1);
+    END LOOP;
+
+    UPDATE "fleets" SET "last_event_seq" = "last_event_seq" + 1 WHERE "id" = changed."fleet_id"
+      RETURNING "last_event_seq" INTO next_seq;
+    INSERT INTO "events" ("id", "fleet_id", "type", "occurred_at", "ship_id", "details", "seq")
+    VALUES (
+      'evt_' || body,
+      changed."fleet_id",
+      'ScopesChanged',
+      at,
+      changed."id",
+      jsonb_build_object('added', changed."added", 'removed', ''),
+      next_seq
+    );
+  END LOOP;
+END;
+$$;

package/src/adapters/prisma/migrations/20261020180000_verified_facts/migration.sql

@@ -0,0 +1,21 @@
+-- One writer's verified facts about a ship (decision 0059): what it checked, set whole and kept with the ship.
+-- CreateEnum
+CREATE TYPE "fact_writer_kind" AS ENUM ('ship', 'account', 'installation');
+
+-- CreateTable
+CREATE TABLE "verified_facts" (
+    "fleet_id" TEXT NOT NULL,
+    "ship_id" TEXT NOT NULL,
+    "writer_kind" "fact_writer_kind" NOT NULL,
+    "writer" TEXT NOT NULL,
+    "facts" JSONB NOT NULL,
+    "written_at" TIMESTAMPTZ(3) NOT NULL,
+
+    CONSTRAINT "verified_facts_pkey" PRIMARY KEY ("fleet_id","ship_id","writer_kind","writer")
+);
+
+-- AddForeignKey
+ALTER TABLE "verified_facts" ADD CONSTRAINT "verified_facts_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "verified_facts" ADD CONSTRAINT "verified_facts_fleet_id_ship_id_fkey" FOREIGN KEY ("fleet_id", "ship_id") REFERENCES "ships"("fleet_id", "id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020190000_verified_facts_by_writer/migration.sql

@@ -0,0 +1,3 @@
+-- A retiring writer finds its verified facts about every ship (decision 0059).
+-- CreateIndex
+CREATE INDEX "verified_facts_fleet_id_writer_kind_writer_idx" ON "verified_facts"("fleet_id", "writer_kind", "writer");