@agentsdock/server 1.0.7-beta.5

package/server/agentsdock_team_hub/migrations/0009_team_messages.sql

@@ -0,0 +1,324 @@
+-- Team Messages V2.  One team messaging model with attachments plus a
+-- versioned Skills library.  Messages are passive records: creating one never
+-- starts, steers, or authorizes an agent.  Messages and skill versions are
+-- immutable; skills carry only pin, archive, and current-version pointers.
+-- Attachment bytes live outside SQLite in a content-addressed directory; this
+-- schema stores their metadata and upload state only.
+
+CREATE TABLE team_skills (
+    id TEXT PRIMARY KEY,
+    team_id TEXT NOT NULL REFERENCES teams(id) ON DELETE RESTRICT,
+    slug TEXT NOT NULL
+        CHECK(slug = lower(trim(slug)))
+        CHECK(length(slug) BETWEEN 1 AND 64),
+    title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 160),
+    summary TEXT NOT NULL DEFAULT '' CHECK(length(summary) <= 280),
+    tags_json TEXT NOT NULL DEFAULT '[]'
+        CHECK(json_valid(tags_json) AND json_type(tags_json) = 'array'),
+    current_version INTEGER NOT NULL DEFAULT 1 CHECK(current_version >= 1),
+    created_by_principal_id TEXT NOT NULL REFERENCES principals(id) ON DELETE RESTRICT,
+    pinned_at INTEGER CHECK(pinned_at IS NULL OR pinned_at >= 0),
+    pinned_by_principal_id TEXT REFERENCES principals(id) ON DELETE RESTRICT,
+    archived_at INTEGER CHECK(archived_at IS NULL OR archived_at >= created_at),
+    archived_by_principal_id TEXT REFERENCES principals(id) ON DELETE RESTRICT,
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    updated_at INTEGER NOT NULL CHECK(updated_at >= created_at),
+    UNIQUE(team_id, slug),
+    UNIQUE(team_id, id),
+    CHECK((pinned_at IS NULL) = (pinned_by_principal_id IS NULL)),
+    CHECK((archived_at IS NULL) = (archived_by_principal_id IS NULL))
+);
+
+CREATE INDEX team_skills_listing
+ON team_skills(team_id, archived_at, pinned_at, updated_at);
+
+CREATE TRIGGER team_skills_require_team_creator
+BEFORE INSERT ON team_skills
+FOR EACH ROW WHEN NOT EXISTS (
+    SELECT 1 FROM principals AS p
+    WHERE p.id = NEW.created_by_principal_id
+      AND p.status = 'active'
+      AND p.kind IN ('human', 'service', 'agent')
+      AND (
+        p.scope_team_id = NEW.team_id
+        OR EXISTS (
+            SELECT 1 FROM memberships AS m
+            WHERE m.team_id = NEW.team_id
+              AND m.principal_id = p.id
+              AND m.status = 'active'
+        )
+      )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'team skill creator does not belong to this team');
+END;
+
+CREATE TRIGGER team_skills_limit_per_team
+BEFORE INSERT ON team_skills
+FOR EACH ROW WHEN (
+    SELECT COUNT(*) FROM team_skills WHERE team_id = NEW.team_id
+) >= 500
+BEGIN
+    SELECT RAISE(ABORT, 'team skill limit exceeded');
+END;
+
+CREATE TRIGGER team_skill_identity_is_immutable
+BEFORE UPDATE OF id, team_id, slug, created_by_principal_id, created_at
+ON team_skills
+BEGIN
+    SELECT RAISE(ABORT, 'team skill identity is immutable');
+END;
+
+CREATE TRIGGER team_skills_cannot_be_deleted
+BEFORE DELETE ON team_skills
+BEGIN
+    SELECT RAISE(ABORT, 'team skills are archived, never deleted');
+END;
+
+CREATE TABLE team_messages (
+    queue_ordinal INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE,
+    team_id TEXT NOT NULL REFERENCES teams(id) ON DELETE RESTRICT,
+    kind TEXT NOT NULL CHECK(kind IN ('message', 'skill')),
+    title TEXT CHECK(title IS NULL OR length(trim(title)) BETWEEN 1 AND 160),
+    body_format TEXT NOT NULL DEFAULT 'markdown' CHECK(body_format IN ('plain', 'markdown')),
+    body TEXT NOT NULL CHECK(length(CAST(body AS BLOB)) BETWEEN 1 AND 49152),
+    body_sha256 BLOB NOT NULL
+        CHECK(typeof(body_sha256) = 'blob' AND length(body_sha256) = 32),
+    sender_kind TEXT NOT NULL CHECK(sender_kind IN ('human', 'server')),
+    sender_principal_id TEXT NOT NULL REFERENCES principals(id) ON DELETE RESTRICT,
+    sender_node_id TEXT,
+    provenance_json TEXT NOT NULL DEFAULT '{}'
+        CHECK(
+            json_valid(provenance_json)
+            AND json_type(provenance_json) = 'object'
+            AND length(provenance_json) <= 2048
+        ),
+    in_reply_to_message_id TEXT,
+    skill_id TEXT,
+    skill_version INTEGER CHECK(skill_version IS NULL OR skill_version >= 1),
+    attachment_count INTEGER NOT NULL DEFAULT 0 CHECK(attachment_count BETWEEN 0 AND 16),
+    attachment_bytes INTEGER NOT NULL DEFAULT 0 CHECK(attachment_bytes >= 0),
+    idempotency_key BLOB NOT NULL
+        CHECK(typeof(idempotency_key) = 'blob' AND length(idempotency_key) = 32),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    FOREIGN KEY(team_id, sender_node_id) REFERENCES nodes(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, in_reply_to_message_id)
+        REFERENCES team_messages(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, skill_id) REFERENCES team_skills(team_id, id) ON DELETE RESTRICT,
+    UNIQUE(team_id, id),
+    UNIQUE(team_id, idempotency_key),
+    CHECK(
+        (sender_kind = 'human' AND sender_node_id IS NULL)
+        OR (sender_kind = 'server' AND sender_node_id IS NOT NULL)
+    ),
+    CHECK(
+        (kind = 'skill' AND title IS NOT NULL AND skill_id IS NOT NULL AND skill_version IS NOT NULL)
+        OR (kind = 'message' AND skill_id IS NULL AND skill_version IS NULL)
+    )
+);
+
+CREATE INDEX team_messages_team_order ON team_messages(team_id, queue_ordinal);
+CREATE INDEX team_messages_sender ON team_messages(team_id, sender_principal_id, queue_ordinal);
+
+CREATE TRIGGER team_messages_require_team_sender
+BEFORE INSERT ON team_messages
+FOR EACH ROW WHEN NOT EXISTS (
+    SELECT 1 FROM principals AS p
+    WHERE p.id = NEW.sender_principal_id
+      AND p.status = 'active'
+      AND p.kind IN ('human', 'service', 'agent')
+      AND (
+        p.scope_team_id = NEW.team_id
+        OR EXISTS (
+            SELECT 1 FROM memberships AS m
+            WHERE m.team_id = NEW.team_id
+              AND m.principal_id = p.id
+              AND m.status = 'active'
+        )
+      )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'team message sender does not belong to this team');
+END;
+
+CREATE TRIGGER team_messages_are_immutable
+BEFORE UPDATE ON team_messages
+BEGIN
+    SELECT RAISE(ABORT, 'team messages are immutable');
+END;
+
+CREATE TRIGGER team_messages_cannot_be_deleted
+BEFORE DELETE ON team_messages
+BEGIN
+    SELECT RAISE(ABORT, 'team messages cannot be deleted');
+END;
+
+CREATE TABLE team_message_recipients (
+    id TEXT PRIMARY KEY,
+    team_id TEXT NOT NULL,
+    message_id TEXT NOT NULL,
+    recipient_kind TEXT NOT NULL CHECK(recipient_kind IN ('server', 'human', 'all')),
+    recipient_node_id TEXT,
+    recipient_principal_id TEXT REFERENCES principals(id) ON DELETE RESTRICT,
+    state TEXT NOT NULL DEFAULT 'available'
+        CHECK(state IN ('available', 'delivered', 'read')),
+    delivered_at INTEGER CHECK(delivered_at IS NULL OR delivered_at >= 0),
+    read_at INTEGER CHECK(read_at IS NULL OR read_at >= 0),
+    FOREIGN KEY(team_id, message_id) REFERENCES team_messages(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, recipient_node_id) REFERENCES nodes(team_id, id) ON DELETE RESTRICT,
+    UNIQUE(team_id, id),
+    CHECK(
+        (recipient_kind = 'server' AND recipient_node_id IS NOT NULL AND recipient_principal_id IS NULL)
+        OR (recipient_kind = 'human' AND recipient_principal_id IS NOT NULL AND recipient_node_id IS NULL)
+        OR (recipient_kind = 'all' AND recipient_node_id IS NULL AND recipient_principal_id IS NULL)
+    ),
+    CHECK(
+        (state = 'available' AND delivered_at IS NULL AND read_at IS NULL)
+        OR (state = 'delivered' AND delivered_at IS NOT NULL AND read_at IS NULL)
+        OR (state = 'read' AND delivered_at IS NOT NULL AND read_at IS NOT NULL)
+    )
+);
+
+CREATE UNIQUE INDEX team_message_recipients_one_per_target
+ON team_message_recipients(
+    message_id,
+    recipient_kind,
+    COALESCE(recipient_node_id, recipient_principal_id, '')
+);
+
+CREATE INDEX team_message_recipients_inbox
+ON team_message_recipients(team_id, recipient_kind, recipient_node_id, recipient_principal_id, state);
+
+CREATE TRIGGER team_message_recipient_identity_is_immutable
+BEFORE UPDATE OF id, team_id, message_id, recipient_kind, recipient_node_id,
+    recipient_principal_id
+ON team_message_recipients
+BEGIN
+    SELECT RAISE(ABORT, 'team message recipient identity is immutable');
+END;
+
+CREATE TRIGGER team_message_recipient_state_is_monotonic
+BEFORE UPDATE OF state, delivered_at, read_at ON team_message_recipients
+FOR EACH ROW WHEN
+    (OLD.state = 'delivered' AND NEW.state = 'available')
+    OR (OLD.state = 'read' AND NEW.state <> 'read')
+    OR (OLD.delivered_at IS NOT NULL AND NEW.delivered_at IS NOT OLD.delivered_at)
+    OR (OLD.read_at IS NOT NULL AND NEW.read_at IS NOT OLD.read_at)
+    OR OLD.recipient_kind = 'all'
+BEGIN
+    SELECT RAISE(ABORT, 'team message receipts are monotonic');
+END;
+
+CREATE TRIGGER team_message_recipients_cannot_be_deleted
+BEFORE DELETE ON team_message_recipients
+BEGIN
+    SELECT RAISE(ABORT, 'team message recipients cannot be deleted');
+END;
+
+CREATE TABLE team_attachments (
+    id TEXT PRIMARY KEY,
+    team_id TEXT NOT NULL REFERENCES teams(id) ON DELETE RESTRICT,
+    message_id TEXT,
+    file_name TEXT NOT NULL
+        CHECK(length(file_name) BETWEEN 1 AND 255)
+        CHECK(instr(file_name, '/') = 0 AND instr(file_name, '\') = 0)
+        CHECK(file_name NOT IN ('.', '..')),
+    media_type TEXT NOT NULL CHECK(length(trim(media_type)) BETWEEN 3 AND 160),
+    byte_size INTEGER NOT NULL CHECK(byte_size >= 1),
+    sha256 BLOB NOT NULL CHECK(typeof(sha256) = 'blob' AND length(sha256) = 32),
+    storage_key TEXT NOT NULL CHECK(length(storage_key) = 64 AND storage_key = lower(storage_key)),
+    state TEXT NOT NULL DEFAULT 'uploading' CHECK(state IN ('uploading', 'ready', 'failed')),
+    received_bytes INTEGER NOT NULL DEFAULT 0 CHECK(received_bytes >= 0),
+    uploaded_by_principal_id TEXT NOT NULL REFERENCES principals(id) ON DELETE RESTRICT,
+    uploader_node_id TEXT,
+    idempotency_key BLOB NOT NULL
+        CHECK(typeof(idempotency_key) = 'blob' AND length(idempotency_key) = 32),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    ready_at INTEGER CHECK(ready_at IS NULL OR ready_at >= created_at),
+    expires_at INTEGER NOT NULL CHECK(expires_at > created_at),
+    FOREIGN KEY(team_id, message_id) REFERENCES team_messages(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, uploader_node_id) REFERENCES nodes(team_id, id) ON DELETE RESTRICT,
+    UNIQUE(team_id, id),
+    UNIQUE(team_id, idempotency_key),
+    CHECK(received_bytes <= byte_size),
+    CHECK(
+        (state = 'ready' AND ready_at IS NOT NULL AND received_bytes = byte_size)
+        OR (state <> 'ready' AND ready_at IS NULL)
+    ),
+    CHECK(message_id IS NULL OR state = 'ready')
+);
+
+CREATE INDEX team_attachments_by_message ON team_attachments(team_id, message_id);
+CREATE INDEX team_attachments_by_storage ON team_attachments(storage_key, state);
+CREATE INDEX team_attachments_pending ON team_attachments(state, expires_at);
+
+CREATE TRIGGER team_attachment_identity_is_immutable
+BEFORE UPDATE OF id, team_id, file_name, media_type, byte_size, sha256,
+    storage_key, uploaded_by_principal_id, uploader_node_id, idempotency_key,
+    created_at
+ON team_attachments
+BEGIN
+    SELECT RAISE(ABORT, 'team attachment identity is immutable');
+END;
+
+CREATE TRIGGER team_attachment_binding_is_permanent
+BEFORE UPDATE OF message_id ON team_attachments
+FOR EACH ROW WHEN OLD.message_id IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'team attachment is already bound to a message');
+END;
+
+CREATE TRIGGER team_attachment_state_is_forward_only
+BEFORE UPDATE OF state ON team_attachments
+FOR EACH ROW WHEN OLD.state <> 'uploading' AND NEW.state <> OLD.state
+BEGIN
+    SELECT RAISE(ABORT, 'team attachment state is terminal');
+END;
+
+CREATE TRIGGER team_attachments_bound_cannot_be_deleted
+BEFORE DELETE ON team_attachments
+FOR EACH ROW WHEN OLD.message_id IS NOT NULL OR OLD.state = 'ready'
+BEGIN
+    SELECT RAISE(ABORT, 'ready or bound team attachments cannot be deleted');
+END;
+
+CREATE TABLE team_skill_versions (
+    id TEXT PRIMARY KEY,
+    team_id TEXT NOT NULL,
+    skill_id TEXT NOT NULL,
+    version INTEGER NOT NULL CHECK(version >= 1),
+    message_id TEXT NOT NULL,
+    title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 160),
+    summary TEXT NOT NULL DEFAULT '' CHECK(length(summary) <= 280),
+    tags_json TEXT NOT NULL DEFAULT '[]'
+        CHECK(json_valid(tags_json) AND json_type(tags_json) = 'array'),
+    change_note TEXT NOT NULL DEFAULT '' CHECK(length(change_note) <= 280),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    FOREIGN KEY(team_id, skill_id) REFERENCES team_skills(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, message_id) REFERENCES team_messages(team_id, id) ON DELETE RESTRICT,
+    UNIQUE(skill_id, version),
+    UNIQUE(message_id),
+    UNIQUE(team_id, id)
+);
+
+CREATE TRIGGER team_skill_versions_limit
+BEFORE INSERT ON team_skill_versions
+FOR EACH ROW WHEN (
+    SELECT COUNT(*) FROM team_skill_versions WHERE skill_id = NEW.skill_id
+) >= 200
+BEGIN
+    SELECT RAISE(ABORT, 'team skill version limit exceeded');
+END;
+
+CREATE TRIGGER team_skill_versions_are_immutable
+BEFORE UPDATE ON team_skill_versions
+BEGIN
+    SELECT RAISE(ABORT, 'team skill versions are immutable');
+END;
+
+CREATE TRIGGER team_skill_versions_cannot_be_deleted
+BEFORE DELETE ON team_skill_versions
+BEGIN
+    SELECT RAISE(ABORT, 'team skill versions cannot be deleted');
+END;

package/server/agentsdock_team_hub/migrations/0010_team_attachment_orphan_reclamation.sql

@@ -0,0 +1,52 @@
+-- Team attachment declarations are intentionally retryable for a bounded
+-- window, but an unbound ready upload is not durable message content. Permit
+-- the store's expiry collector to reclaim those orphan rows while continuing
+-- to make message-bound attachments undeletable.
+
+DROP TRIGGER team_attachments_bound_cannot_be_deleted;
+
+CREATE TRIGGER team_attachments_bound_cannot_be_deleted
+BEFORE DELETE ON team_attachments
+FOR EACH ROW WHEN OLD.message_id IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'bound team attachments cannot be deleted');
+END;
+
+-- The opportunistic collector always walks oldest expired declarations first.
+-- Partial indexes keep both its team-scoped hot path and its maintenance-wide
+-- path bounded by the requested LIMIT without sorting or scanning live rows.
+CREATE INDEX team_attachments_reclaim_expired_by_team
+ON team_attachments(team_id, expires_at, id)
+WHERE message_id IS NULL;
+
+CREATE INDEX team_attachments_reclaim_expired_global
+ON team_attachments(expires_at, id)
+WHERE message_id IS NULL;
+
+-- Metadata deletion and physical deletion are separate commit points. Record
+-- exact, validated relative-path components before deleting metadata so a
+-- failed unlink (or a process crash after commit) remains durably retryable.
+-- A later collector rechecks active metadata references before touching bytes.
+CREATE TABLE team_attachment_cleanup_queue (
+    path_kind TEXT NOT NULL CHECK(path_kind IN ('staging', 'content')),
+    path_key TEXT NOT NULL,
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    attempt_count INTEGER NOT NULL DEFAULT 0 CHECK(attempt_count >= 0),
+    PRIMARY KEY(path_kind, path_key),
+    CHECK(
+        (
+            path_kind = 'staging'
+            AND length(path_key) = 37
+            AND substr(path_key, 1, 5) = 'tatt_'
+            AND substr(path_key, 6) NOT GLOB '*[^0-9a-f]*'
+        )
+        OR (
+            path_kind = 'content'
+            AND length(path_key) = 64
+            AND path_key NOT GLOB '*[^0-9a-f]*'
+        )
+    )
+);
+
+CREATE INDEX team_attachment_cleanup_queue_oldest
+ON team_attachment_cleanup_queue(attempt_count, created_at, path_kind, path_key);

package/server/agentsdock_team_hub/migrations/0011_human_admin_paging.sql

@@ -0,0 +1,65 @@
+-- Bound owner/self-service administration scans to their keyset order.
+-- The append-only AUTOINCREMENT ledger gives a traversal a stable high-water:
+-- SQLite table rowids can otherwise be reused after deletion.
+CREATE TABLE human_admin_page_entries (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    resource_kind TEXT NOT NULL
+        CHECK(resource_kind IN ('device_session', 'invitation', 'membership')),
+    resource_id TEXT NOT NULL,
+    UNIQUE(resource_kind, resource_id)
+);
+
+INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+SELECT 'device_session', id FROM device_sessions ORDER BY rowid;
+INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+SELECT 'invitation', id FROM invitations ORDER BY rowid;
+INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+SELECT 'membership', id FROM memberships ORDER BY rowid;
+
+CREATE TRIGGER human_admin_page_device_session_insert
+AFTER INSERT ON device_sessions
+BEGIN
+    INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+    VALUES ('device_session', NEW.id);
+END;
+
+CREATE TRIGGER human_admin_page_invitation_insert
+AFTER INSERT ON invitations
+BEGIN
+    INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+    VALUES ('invitation', NEW.id);
+END;
+
+CREATE TRIGGER human_admin_page_membership_insert
+AFTER INSERT ON memberships
+BEGIN
+    INSERT INTO human_admin_page_entries(resource_kind, resource_id)
+    VALUES ('membership', NEW.id);
+END;
+
+CREATE TRIGGER human_admin_page_entries_immutable
+BEFORE UPDATE ON human_admin_page_entries
+BEGIN
+    SELECT RAISE(ABORT, 'human administration page sequence is immutable');
+END;
+
+CREATE TRIGGER human_admin_page_entries_cannot_be_deleted
+BEFORE DELETE ON human_admin_page_entries
+BEGIN
+    SELECT RAISE(ABORT, 'human administration page sequence cannot be deleted');
+END;
+
+CREATE INDEX device_sessions_human_created_id_idx
+ON device_sessions(human_principal_id, created_at DESC, id DESC);
+
+CREATE INDEX invitations_pending_team_created_id_idx
+ON invitations(team_id, created_at DESC, id DESC)
+WHERE redeemed_at IS NULL AND revoked_at IS NULL;
+
+CREATE INDEX memberships_active_team_created_principal_idx
+ON memberships(team_id, created_at DESC, principal_id DESC)
+WHERE status = 'active';
+
+CREATE INDEX memberships_manageable_team_created_principal_idx
+ON memberships(team_id, created_at DESC, principal_id DESC)
+WHERE status IN ('active', 'suspended');

package/server/agentsdock_team_hub/migrations/0012_network_content_deletions.sql

@@ -0,0 +1,69 @@
+-- Immutable soft-deletion journal for Team Messages V2 and the legacy Team
+-- Network bulletin. Source records and bound attachment blobs remain
+-- immutable; readers suppress content through this additive ledger.
+
+CREATE TABLE network_content_deletions (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE,
+    team_id TEXT NOT NULL REFERENCES teams(id) ON DELETE RESTRICT,
+    resource_kind TEXT NOT NULL CHECK(resource_kind IN ('message', 'bulletin')),
+    resource_id TEXT NOT NULL,
+    deleted_by_principal_id TEXT NOT NULL
+        REFERENCES principals(id) ON DELETE RESTRICT,
+    deleted_at INTEGER NOT NULL CHECK(deleted_at >= 0),
+    UNIQUE(team_id, resource_kind, resource_id)
+);
+
+CREATE INDEX network_content_deletions_team_sequence
+ON network_content_deletions(team_id, sequence);
+
+CREATE TRIGGER network_content_deletions_require_message
+BEFORE INSERT ON network_content_deletions
+FOR EACH ROW WHEN NEW.resource_kind = 'message' AND NOT EXISTS (
+    SELECT 1 FROM team_messages AS m
+    WHERE m.team_id = NEW.team_id AND m.id = NEW.resource_id
+      AND m.kind = 'message'
+)
+BEGIN
+    SELECT RAISE(ABORT, 'team message deletion source is unavailable');
+END;
+
+CREATE TRIGGER network_content_deletions_require_bulletin
+BEFORE INSERT ON network_content_deletions
+FOR EACH ROW WHEN NEW.resource_kind = 'bulletin' AND NOT EXISTS (
+    SELECT 1
+    FROM messages AS m
+    JOIN network_boards AS b
+      ON b.team_id = m.team_id AND b.channel_id = m.channel_id
+    WHERE m.team_id = NEW.team_id AND m.id = NEW.resource_id
+)
+BEGIN
+    SELECT RAISE(ABORT, 'bulletin deletion source is unavailable');
+END;
+
+CREATE TRIGGER network_content_deletions_require_team_actor
+BEFORE INSERT ON network_content_deletions
+FOR EACH ROW WHEN NOT EXISTS (
+    SELECT 1
+    FROM principals AS p
+    JOIN memberships AS m
+      ON m.team_id = NEW.team_id AND m.principal_id = p.id
+    WHERE p.id = NEW.deleted_by_principal_id
+      AND p.status = 'active'
+      AND m.status = 'active'
+)
+BEGIN
+    SELECT RAISE(ABORT, 'deletion actor does not belong to this team');
+END;
+
+CREATE TRIGGER network_content_deletions_are_immutable
+BEFORE UPDATE ON network_content_deletions
+BEGIN
+    SELECT RAISE(ABORT, 'network content deletions are immutable');
+END;
+
+CREATE TRIGGER network_content_deletions_cannot_be_deleted
+BEFORE DELETE ON network_content_deletions
+BEGIN
+    SELECT RAISE(ABORT, 'network content deletions cannot be deleted');
+END;

package/server/agentsdock_team_hub/migrations/0013_team_message_revisions.sql

@@ -0,0 +1,48 @@
+-- Immutable, author-only revisions for ordinary Team Messages. The original
+-- team_messages row remains version 1; every edit appends a new body revision.
+
+CREATE TABLE team_message_revisions (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE,
+    team_id TEXT NOT NULL,
+    message_id TEXT NOT NULL,
+    version INTEGER NOT NULL CHECK(version >= 2),
+    body_format TEXT NOT NULL CHECK(body_format IN ('plain', 'markdown')),
+    body TEXT NOT NULL CHECK(length(CAST(body AS BLOB)) BETWEEN 1 AND 49152),
+    body_sha256 BLOB NOT NULL
+        CHECK(typeof(body_sha256) = 'blob' AND length(body_sha256) = 32),
+    editor_kind TEXT NOT NULL CHECK(editor_kind IN ('human', 'server')),
+    edited_by_principal_id TEXT NOT NULL REFERENCES principals(id) ON DELETE RESTRICT,
+    editor_node_id TEXT,
+    idempotency_key BLOB NOT NULL
+        CHECK(typeof(idempotency_key) = 'blob' AND length(idempotency_key) = 32),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0),
+    FOREIGN KEY(team_id, message_id)
+        REFERENCES team_messages(team_id, id) ON DELETE RESTRICT,
+    FOREIGN KEY(team_id, editor_node_id)
+        REFERENCES nodes(team_id, id) ON DELETE RESTRICT,
+    UNIQUE(team_id, message_id, version),
+    UNIQUE(team_id, message_id, idempotency_key),
+    CHECK(
+        (editor_kind = 'human' AND editor_node_id IS NULL)
+        OR (editor_kind = 'server' AND editor_node_id IS NOT NULL)
+    )
+);
+
+CREATE INDEX team_message_revisions_by_message
+ON team_message_revisions(team_id, message_id, version DESC);
+
+CREATE INDEX team_message_revisions_by_team
+ON team_message_revisions(team_id, sequence);
+
+CREATE TRIGGER team_message_revisions_are_immutable
+BEFORE UPDATE ON team_message_revisions
+BEGIN
+    SELECT RAISE(ABORT, 'team message revisions are immutable');
+END;
+
+CREATE TRIGGER team_message_revisions_cannot_be_deleted
+BEFORE DELETE ON team_message_revisions
+BEGIN
+    SELECT RAISE(ABORT, 'team message revisions cannot be deleted');
+END;

package/server/agentsdock_team_hub/migrations/0014_managed_network_owner.sql

@@ -0,0 +1,50 @@
+-- A server-created shared network has one internal service owner. Ordinary
+-- services still cannot acquire human membership roles or own personal teams.
+DROP TRIGGER memberships_require_compatible_principal;
+DROP TRIGGER memberships_update_requires_compatible_principal;
+
+CREATE TRIGGER memberships_require_compatible_principal
+BEFORE INSERT ON memberships
+FOR EACH ROW WHEN NOT (
+    (NEW.role = 'automation' AND COALESCE(
+        (SELECT kind FROM principals WHERE id = NEW.principal_id), ''
+    ) = 'service')
+    OR (NEW.role <> 'automation' AND COALESCE(
+        (SELECT kind FROM principals WHERE id = NEW.principal_id), ''
+    ) = 'human')
+    OR (NEW.role = 'owner' AND NEW.principal_id = 'service_managed_network_owner'
+        AND EXISTS (
+            SELECT 1 FROM principals p JOIN service_accounts s ON s.principal_id=p.id
+            JOIN teams t ON t.id=NEW.team_id
+            JOIN managed_host_bindings b ON b.singleton=1
+            WHERE p.id=NEW.principal_id AND p.kind='service' AND p.status='active'
+              AND s.service_identifier='agentsdock.team-hub.managed-network-owner'
+              AND t.kind='shared' AND t.created_by_principal_id=p.id
+        ))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'membership role is incompatible with principal kind');
+END;
+
+CREATE TRIGGER memberships_update_requires_compatible_principal
+BEFORE UPDATE OF principal_id, role ON memberships
+FOR EACH ROW WHEN NOT (
+    (NEW.role = 'automation' AND COALESCE(
+        (SELECT kind FROM principals WHERE id = NEW.principal_id), ''
+    ) = 'service')
+    OR (NEW.role <> 'automation' AND COALESCE(
+        (SELECT kind FROM principals WHERE id = NEW.principal_id), ''
+    ) = 'human')
+    OR (NEW.role = 'owner' AND NEW.principal_id = 'service_managed_network_owner'
+        AND EXISTS (
+            SELECT 1 FROM principals p JOIN service_accounts s ON s.principal_id=p.id
+            JOIN teams t ON t.id=NEW.team_id
+            JOIN managed_host_bindings b ON b.singleton=1
+            WHERE p.id=NEW.principal_id AND p.kind='service' AND p.status='active'
+              AND s.service_identifier='agentsdock.team-hub.managed-network-owner'
+              AND t.kind='shared' AND t.created_by_principal_id=p.id
+        ))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'membership role is incompatible with principal kind');
+END;

package/server/agentsdock_team_hub/migrations/0015_team_message_inbox_dismissals.sql

@@ -0,0 +1,3 @@
+-- Inbox removal belongs to one addressed mailbox, never the shared message.
+ALTER TABLE team_message_recipients ADD COLUMN dismissed_at INTEGER
+    CHECK(dismissed_at IS NULL OR dismissed_at >= 0);

package/server/agentsdock_team_hub/migrations/0016_team_message_all_servers.sql

@@ -0,0 +1,4 @@
+-- Explicitly mark new all-server inbox mail. Historical shared Bulletin rows
+-- retain NULL and are never expanded or reclassified as mail.
+ALTER TABLE team_messages ADD COLUMN destination TEXT
+    CHECK(destination IS NULL OR destination = 'all_servers');

package/server/agentsdock_team_hub/migrations/0017_skill_announcement_deletions.sql

@@ -0,0 +1,16 @@
+-- A skill version's announcement may be hidden independently of the library.
+-- Keep the original message, immutable versions, and bound attachments intact.
+-- Poster authorization remains in HubStore; the journal retains its existing
+-- same-team actor and append-only constraints.
+DROP TRIGGER network_content_deletions_require_message;
+
+CREATE TRIGGER network_content_deletions_require_message
+BEFORE INSERT ON network_content_deletions
+FOR EACH ROW WHEN NEW.resource_kind = 'message' AND NOT EXISTS (
+    SELECT 1 FROM team_messages AS m
+    WHERE m.team_id = NEW.team_id AND m.id = NEW.resource_id
+      AND m.kind IN ('message', 'skill')
+)
+BEGIN
+    SELECT RAISE(ABORT, 'team message deletion source is unavailable');
+END;

package/server/agentsdock_team_hub/migrations/0018_team_mail_subjects.sql

@@ -0,0 +1,8 @@
+-- Subjects are opt-in on the wire. Never backfill the legacy title column:
+-- old ordinary-message titles were intentionally hidden from strict clients.
+-- The existing whole-row immutability trigger also protects this new column.
+ALTER TABLE team_messages ADD COLUMN mail_subject TEXT
+    CHECK(mail_subject IS NULL OR (
+        kind = 'message' AND typeof(mail_subject) = 'text'
+        AND length(mail_subject) BETWEEN 1 AND 160
+    ));

package/server/agentsdock_team_hub/migrations/0019_team_mailbox_state.sql

@@ -0,0 +1,5 @@
+-- Inbox attention is independent of historical delivery/read receipts.
+ALTER TABLE team_message_recipients ADD COLUMN inbox_unread INTEGER
+    CHECK(inbox_unread IS NULL OR inbox_unread IN (0, 1));
+ALTER TABLE team_message_recipients ADD COLUMN mailbox_state_version INTEGER NOT NULL DEFAULT 0
+    CHECK(mailbox_state_version >= 0);