@agentsfleet/orly 0.14.4 → 0.14.6

package/AGENTS.md

@@ -16,7 +16,7 @@ You are this repository's coding agent: deterministic, autonomous, command-line-
 
 **The human is Kishore** — casual handle **Indy**; either name, any case, addresses him. Ambiguous "the user" / "they" here = Kishore. The agent is **Oracle**, casual handle **Aiwa**. `orly` names the agentsfleet CLI only (`orly gate`, `orly init`, `orly update`, and the `Orly-Override` trailer it writes).
 
-**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `core.fleet_*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
+**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `fleet.*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
 
 MacBook. Languages: Python, Go, Rust, TypeScript, Zig. Tooling: `mise` first, `brew` fallback. Forges: `gh`/`glab`. Commit identity from `git config`, never here.
 

package/README.md

@@ -78,7 +78,7 @@ TypeSafe's Jev model supplies runtime advice through explicit `orly judge` reque
 
 See [releases](https://github.com/agentsfleet/orly/releases) for published versions.
 The install commands below fetch the published package.
-The release workflow publishes 0.14.4 after its version change merges to `main`.
+The release workflow publishes 0.14.6 after its version change merges to `main`.
 
 ---
 

package/audits/agents-md.md

@@ -179,7 +179,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 11.1 | Only under the explicit `product.agentsfleet` pack, is its pre-v0.30.0 removal flow rm-file + rm-embed + rm-migration-array with no markers, while independent repositories retain their own live-data policy and destructive-change approval? | YES |
+| 11.1 | Only under the explicit `product.agentsfleet` pack, is its pre-v0.30.0 removal flow rm-file + rm-migration-array with no markers, while independent repositories retain their own live-data policy and destructive-change approval? | YES |
 | 11.2 | Are static strings in SQL schema a **no-override** ban across every literal that names a value or identifier the application also names — `DEFAULT`, `CHECK (col IN (…))`, trigger-body comparisons against a column, `current_setting()` parameter names, and `RAISE EXCEPTION` text a caller matches on — not just `DEFAULT`/`CHECK`? | YES |
 
 ### Scenario 12 — Auto-mode boundary (added)

package/audits/spec-template.ts

@@ -7,7 +7,7 @@ type Section = { title: string; nodes: MarkdownNode[] };
 type Commands = Record<string, string[][]>;
 
 const CONFIG_PATH = ".orly/orly.json";
-const SPEC_LINE_LIMIT = 320;
+const SPEC_LINE_LIMIT = 500;
 const BACKTICK = "`";
 const EMPTY = "";
 const PIPE_OUTPUT = "pipe";

package/core/operating-model.md

@@ -11,7 +11,7 @@ You are this repository's coding agent: deterministic, autonomous, command-line-
 
 **The human is Kishore** — casual handle **Indy**; either name, any case, addresses him. Ambiguous "the user" / "they" here = Kishore. The agent is **Oracle**, casual handle **Aiwa**. `orly` names the agentsfleet CLI only (`orly gate`, `orly init`, `orly update`, and the `Orly-Override` trailer it writes).
 
-**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `core.fleet_*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
+**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `fleet.*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
 
 MacBook. Languages: Python, Go, Rust, TypeScript, Zig. Tooling: `mise` first, `brew` fallback. Forges: `gh`/`glab`. Commit identity from `git config`, never here.
 

package/dispatch/write_sql.md

@@ -57,7 +57,6 @@ The **Schema Table Removal Guard** card dissolves into this façade; its prose i
 **Triggers** — before any of these, run `cat VERSION` and print the guard output. `0.30.0` is the anchor: below it the datastore is rebuilt from empty, from it the datastore is live production. Compare the version field by field, never as a string — `0.29.0` is under the anchor and `0.30.0` is not, while a lexical compare puts `0.30.0` under `0.9.0` and reads the era backwards.
 
 - Creating, editing, or deleting any file under `schema/*.sql`.
-- Editing `schema/embed.zig` (any `@embedFile` constant).
 - Editing the canonical migration array in `rustd/crates/afd_db/src/migration.rs`.
 - Writing `DROP TABLE`, `ALTER TABLE`, or `SELECT 1;` into any SQL file.
 - Accepting a spec dimension prescribing a "DROP migration", "ALTER migration", or "version marker".
@@ -73,8 +72,7 @@ The era runs while `VERSION` is under `0.30.0`, and it ends there — the develo
 To remove a table:
 
 1. `rm schema/NNN_foo.sql`
-2. Remove `@embedFile` from `schema/embed.zig`
-3. Remove the entry from the migration array in `rustd/crates/afd_db/src/migration.rs` and update its registration tests.
+2. Remove the entry from the migration array in `rustd/crates/afd_db/src/migration.rs` and update its registration tests.
 
 **Forbidden:** `ALTER TABLE`, `DROP TABLE`, `SELECT 1;` markers, comment-only files, "keep file for slot numbering". Slot gaps are fine — the DB is wiped on rebuild.
 
@@ -91,11 +89,10 @@ The teardown path is closed. Every schema change assumes a live datastore holdin
 ```
 SCHEMA GUARD: VERSION=<v> (<0.30.0 ? teardown : migrate)
   rm:schema/<file>.sql
-  rm-embed:<const>
   rm-migration:v<N>
 ```
 
-Below `0.30.0`, all three rm- lines appear. From `0.30.0`, replace them with `migration:schema/<NNN>_<change>.sql`.
+Below `0.30.0`, both rm- lines appear. From `0.30.0`, replace them with `migration:schema/<NNN>_<change>.sql`.
 <!-- oracle-packs:end -->
 
 ## Companion SQL rules (retained in `docs/greptile-learnings/RULES.md`)

package/dispatch/write_sql.sh

@@ -18,7 +18,7 @@
 # (retained) and the GREPTILE GATE enforces them by review until a leaf exists.
 # SCH's teardown-era forbidden-token floor (no ALTER/DROP/SELECT 1; in schema/*.sql) is
 # itself a build-the-check (TODO-CHECK) candidate; the teardown-vs-ALTER disposition
-# call above it stays JUDGMENT (which file to rm, which @embedFile, which migration index).
+# call above it stays JUDGMENT (which file to rm, which migration index).
 
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
@@ -30,7 +30,7 @@ dispatch_header
 dispatch_length_gate 350                                       # FLL — file ≤ 350
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──
-dispatch_judgment "SCH" "removing/altering a table? cat VERSION and compare field by field, not as a string — below 0.30.0 = full teardown (rm schema/NNN.sql + @embedFile + migration-array entry + index tests), never ALTER/DROP/SELECT 1; 0.30.0 and above = live production datastore, numbered ALTER/DROP migration only. print the SCHEMA GUARD block"
+dispatch_judgment "SCH" "removing/altering a table? cat VERSION and compare field by field, not as a string — below 0.30.0 = full teardown (rm schema/NNN.sql + migration-array entry + index tests), never ALTER/DROP/SELECT 1; 0.30.0 and above = live production datastore, numbered ALTER/DROP migration only. print the SCHEMA GUARD block"
 dispatch_judgment "ITF" "integration test touching a production table? seed via src/db/test_fixtures_<scope>.zig against the real schema — never CREATE TEMP TABLE mocking the production shape"
 
 dispatch_verdict

package/docs/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.14.6 — 2026-10-17
+
+agentsfleet's schema conventions no longer require migrate to refuse an older migrator's ledger.
+
+- **Schema conventions** — agentsfleet's databases start empty under SQLx's `Migrator`, so no earlier ledger exists to refuse.
+
+## 0.14.5 — 2026-10-17
+
+agentsfleet's schema conventions carry the owner-signed Postgres rules, and specs may run to 500 lines.
+
+- **Schema conventions** — placement in owned schemas, key and counter naming, RULE STS in full, timestamp categories, runtime SQL in `PREPARE`-checked `.sql` files, and SQLx's `Migrator` inside a bounded lock. Entities are named `fleet.*`.
+- **Spec cap** — the spec template gate allows 500 lines, up from 320.
+- **Schema guard** — the teardown flow no longer names the retired `schema/embed.zig`.
+
 ## 0.14.4 — 2026-10-16
 
 The milestone-ID and UI-substitution audit no longer forks per staged file. A pre-commit stage of ~1,600 files that ran over 27 minutes now finishes in about two seconds, with verdicts unchanged.

package/docs/RULE_ENFORCEMENT.md

@@ -8,13 +8,13 @@ regenerates this file and fails on any difference. To update it, run
 |---|---|--:|--:|--:|---|
 | `docs/LOGGING_STANDARD.md` | `LOG` → `logging.sh` | 10 | 13 | 30/30 | mechanical |
 | `docs/REST_API_DESIGN_GUIDELINES.md` | — | 0 | 0 | 0/69 | mechanical |
-| `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/17 | mechanical |
+| `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/12 | mechanical |
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
 | `docs/LIFECYCLE_PATTERNS.md` | — | 0 | 0 | 0/22 | mechanical |
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
 | `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/4 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/115 | mechanical |
-| **corpus** | | | | **30/282** | |
+| **corpus** | | | | **30/277** | |
 
 ## How to read this
 

package/docs/SCHEMA_CONVENTIONS.md

@@ -13,102 +13,115 @@ with the real schema through shared fixture helpers.
 Keep migration registration and position assertions synchronized with each edit.
 
 <!-- oracle-packs:start product.agentsfleet -->
-Canonical reference for `agentsfleet` database schema patterns. All new tables **must** follow these conventions. Existing tables are brought into compliance when rebuilt.
+Canonical reference for `agentsfleet` database schema patterns. All new tables **must** follow these conventions. The table-by-table layout lives in the product repository's `docs/architecture/postgres_schemas.md`; this section carries the rules that layout follows.
 
 ## Migration Model
 
-**Teardown-rebuild is in force for the M154 rebuild (owner decision, Indy, Jul 31, 2026).** The development database is being dropped and re-created from empty while production is undeployed, so slots `001`–`046` are **retired wholesale** and the schema is re-authored by dependency layer. During this rebuild the frozen-slot rule below does not apply, and `ALTER`/`DROP` statements are forbidden rather than required — a change belongs in the base statement it would have patched. This is the posture RULE SCH already specifies for `VERSION < 0.30.0`; the Jul 22 additive model was the deviation.
+**Additive at `VERSION >= 0.30.0`.** Every schema change is a new numbered slot; shipped slots are frozen history. Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) need an explicit owner decision per change. A from-empty rebuild past `0.30.0` happens only under an owner-recorded `SCHEMA GUARD: SKIPPED per user override (reason: …)` with the database dropped first — the M229 rebuild (Oct 17, 2026) is the precedent.
 
-**Additive migrations resume at `VERSION >= 0.30.0`, as RULE SCH specifies.**
-Completing the rebuild alone does not change the version boundary.
-Every subsequent schema change is a new numbered migration file; shipped slots
-are frozen history. Migrations are tracked incrementally through
-`agentsfleetd doctor --schema-gate`; use `IF NOT EXISTS` where appropriate for
-fresh bootstrap and an already provisioned database.
+## Migrator
 
-Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an explicit owner decision per change — additive is the default an agent may author alone.
-
-> Historical note: slots `001`–`031` predate the additive model (teardown-rebuild with inline DDL edits, enforced by a since-removed `check-schema-gate` lint target). M154 retires them along with everything up to `046`.
+SQLx's `Migrator` applies the slots from the explicit list in `rustd/crates/afd_db/src/migration.rs` (`Migrator::with_migrations`; the `migrate` feature only, `macros` stays off). It keeps checksums, so an edited applied slot is refused, and records the ledger in the `audit` schema. Locking is ours: SQLx's lock is off (`set_locking(false)`) and a bounded `pg_try_advisory_lock` poll wraps the run, so a held lock fails loudly instead of hanging a deploy.
 
 ## Schema File Organization
 
-- Each SQL file must be **≤100 lines** and **single-concern** (one table, one logical group, or one additive change).
-- Files are numbered sequentially: `001_core_foundation.sql`, `002_core_workflow.sql`, etc. New migrations append the next number; shipped numbers are never reused or slid.
-- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `rustd/crates/afd_db/src/migration.rs` (migration version array).
-- Below `0.30.0`, remove obsolete slots and their registrations completely;
-  no-op markers are forbidden. At and above `0.30.0`, preserve shipped slots and
-  apply changes through new migrations.
+- One slot per table: the table, its local constraints, indexes and grants together; each file **≤100 lines**.
+- Slots are ordered by foreign key — a table follows every table it references, across schemas. A foreign key that closes a cycle (a head pointer, for example) gets its own registered slot after both tables exist, `DEFERRABLE INITIALLY DEFERRED`.
+- Every slot is registered in `rustd/crates/afd_db/src/migration.rs`; the `rust-migration-list` lint compares the list to the tracked files.
+- Shipped numbers are never reused or slid.
+
+## Placement and naming
+
+1. **Placement.** A table lives in the schema of the product area that owns it (`identity`, `authoring`, `fleet`, `runner`, `connector`, `model`, `billing`, `vault`, `memory`). Its name is a plural noun that never repeats the schema name: `authoring.drafts`, not `authoring.authoring_drafts`. A singleton is named for its one row and says so in its slot.
+2. **Foreign keys** end `_id` and name the table they point at (`user_id`, `draft_id`). A prefix names the role when the column alone would not say it (`invited_by_user_id`, `active_grant_id`, `last_runner_id`). A deliberately missing foreign key is explained in the slot comment.
+3. **Status** columns are named `status`; categories are `<thing>_type`. RULE STS applies in full and without override: no literal that names a value or identifier the application also names — a `DEFAULT`, a `CHECK (col IN (…))` list, a trigger comparison against a column, a `current_setting()` parameter name, or `RAISE EXCEPTION` text a caller matches on. A predicate that needs a state reads a NULL marker column; a privileged path (a purge, for example) is a grant, not a session setting. The only literals left are structural ones nothing in the application names: the UUID version nibble `'7'`, `TG_OP` values, and exception text no caller matches on.
+4. **Timestamps.** Every table has `created_at`; every table whose rows change has `updated_at`. Any other time column is one of: (a) a deadline named `*expires_at`; (b) a NULL marker an index or trigger reads; (c) a domain instant the API returns that `updated_at` cannot carry; (d) an accounting cursor billing reads.
+5. **One fact, one home.** No JSON blob copies a column; no counter restates another table's number. Named exceptions, each with its consistency rule in the slot: an aggregate maintained under the same lock or trigger as its source; a delivery snapshot that must outlive its source; a non-secret projection of encrypted content; a scope copy a restricted role needs to filter alone.
+6. **Retry keys** (`operation_id` plus a request digest) live only in receipt tables.
+7. **Every column names its reader** before it is created. Accounting and audit records are exempt when the slot names the export or verification that reads them.
+8. **A new table** carries a written answer to "why not a column, or an existing table".
+9. **Immutable tables** carry no `updated_at`, no UPDATE grant, and a trigger that refuses UPDATE. DELETE stays governed by grants and the deletion matrix, so cascades keep working.
+
+### Counter and pointer names
+
+| Kind | Name |
+|---|---|
+| Position within a parent (1, 2, 3…) | `sequence` |
+| Pointer to another table's position | `<thing>_sequence` |
+| Highest position so far | `last_<thing>_sequence` |
+| "Everything up to N" watermark | `<verb>_through_sequence` |
+| Global insertion order | `sequence` (identity column) |
+| Frozen content version | `revision`; pointer `<x>_revision_id`; the live one `head_revision_id` |
+| Compare-and-swap edit counter | `resource_version`, or `<scope>_version` when it covers one action |
+| Lease epoch | `fencing_token` |
+| Tally | `<thing>_count` |
+| Deadline | `*expires_at` |
+
+Wire field names (API and runner protocol) are not renamed by these rules.
+
+## Deletion matrix
+
+Every root a user or operator can delete — draft, user, Library card, fleet, workspace, tenant — has a stated row in the product's deletion matrix: what goes with it, what stays, and what is scrubbed at once. Money records (charges, settlements, the attempts they hang off) never cascade from an erasable owner; they keep opaque identifiers. Private text is scrubbed on every erasure path, not only the one that purges drafts.
 
 ## SQL Qualification
 
-- Use schema-qualified table names in SQL (`core.platform_llm_keys`, `core.workspaces`, etc.) for new queries and handlers.
+- Use schema-qualified table names in SQL (`identity.workspaces`, `fleet.fleets`).
 - Do not rely on session `search_path` defaults for correctness.
-- Legacy unqualified queries may remain temporarily, but touched paths should be migrated to schema-qualified names.
+
+## Runtime SQL
+
+- Every static statement lives in a `.sql` file beside the use case that runs it (for example `library/sql/list.sql`), loaded with `include_str!` and bound by a typed Rust function that states its parameters, authorization and locks.
+- Rows decode into named `FromRow` types selected by explicit column lists; `Json<T>` is for real JSON columns only; storage rows stay separate from wire types. No `to_jsonb(<row>)` whole-row reads.
+- One integration test `PREPARE`s every `.sql` file against the rebuilt schema, so a stale table or column fails before merge. A statement that must be assembled at run time is named in its module and covered by its own test.
+- Domain stores take the caller's connection or transaction; there is no generic repository trait.
+- Every pooled runtime connection carries `lock_timeout` and `statement_timeout` named constants; the migrate connection carries neither.
 
 ## Schema-Backed Runtime Defaults
 
-- If a numeric schema default is also used in runtime fallback or provisioning logic, define it once in Zig as a named constant and import that constant in runtime code.
-- Keep the database DDL value unchanged unless the product default is intentionally changing; the Zig constant mirrors the schema default for drift detection.
-- Add an adjacent `Canonical constant:` SQL comment next to each shared numeric default so reviewers can verify the linkage quickly.
+- A numeric schema default also used in runtime fallback or provisioning logic is defined once as a Rust named constant in the owning crate and referenced by the slot comment (`Canonical constant: crate::path::NAME`).
+- Keep the DDL value unchanged unless the product default is intentionally changing.
 
 ## Identity Column
 
-**One identity column per table, named `id` (owner decision, Indy, Jul 31, 2026 — M154).** The earlier `uid` rule paired a generated `uid` primary key with a duplicate twin column (`id`, `tenant_id`, `workspace_id`, …) holding the same value under its own `UNIQUE` constraint. That shape is retired.
+**One identity column per table, named `id` (owner decision, Indy, Jul 31, 2026 — M154).**
 
-- **Column:** `id`
-- **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`
-- **Generation:** Application-side UUID version 7 (UUIDv7) via `rustd/crates/afd_core/src/id.rs`, never `gen_random_uuid()`.
-- **No second unique key on the same value.** This is a correctness rule, not only a storage one: `ON CONFLICT` can arbitrate exactly one constraint, so a table carrying two unique keys over the same value makes two sessions inserting a brand-new row race to a duplicate-key error on the *other* index instead of taking the update arm. `schema/043_runner_lifetime_counters.sql` recorded this before the rule was generalised.
+- **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`, application-minted UUID version 7 (UUIDv7) through `afd_core::id`, never `gen_random_uuid()`.
+- **No second unique key on the same value.** `ON CONFLICT` arbitrates exactly one constraint, so two unique keys over one value make concurrent inserts race to a duplicate-key error on the other index.
 - **Foreign keys reference the primary key**, never a secondary unique constraint.
-- **Constraint:** every table carries a UUIDv7 CHECK:
-  ```sql
-  CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')
-  ```
-- **Adding a new table:** add a `generate{TableName}Id()` function to `rustd/crates/afd_core/src/id.rs`.
-- **API shape:** unchanged — public fields keep exposing `id`, `tenant_id`, `workspace_id` and the other documented names. The column now *is* the public name in most tables, so the aliasing the old rule required mostly disappears; where a public field differs from `id`, alias at the boundary rather than renaming client-facing payloads.
-- **Exceptions,** each stated in the slot that creates the table: a curated catalogue keyed by a stable slug (`core.fleet_library`) and a singleton keyed by a pinned integer (`core.model_catalogue_revision`) carry no UUID.
+- **Constraint:** every UUID-keyed table carries `CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')`.
+- **Exceptions,** each stated in its slot: a row that exists at most once per parent is keyed by the parent (`fleet.sessions`, `fleet.activity_counters`, `runner.fleet_slots`, `runner.lifetime_counters`, `billing.wallets`, `model.tenant_selections`); a singleton keyed by a pinned integer (`model.catalogue_version`); a natural key addressed by every statement (`model.platform_defaults` by `provider`).
 
 ## Timestamps
 
-- **Type:** `BIGINT NOT NULL` — milliseconds since Unix epoch.
-- **Generation:** `std.time.milliTimestamp()` in Zig application code.
-- **Never** use `TIMESTAMPTZ`, `TIMESTAMP`, or `DEFAULT now()`.
+- **Type:** `BIGINT NOT NULL` — milliseconds since the Unix epoch, from the application clock (`afd_core::clock::UnixMillis`).
+- **Never** `TIMESTAMPTZ`, `TIMESTAMP` or `DEFAULT now()`.
 
 ## Standard Columns
 
-Every table must have:
-
 | Column | Type | Required | Notes |
 |--------|------|----------|-------|
-| `id` | `UUID PRIMARY KEY` | Yes | UUIDv7, app-generated; the table's only identity column |
+| `id` | `UUID PRIMARY KEY` | Yes | UUIDv7, application-minted |
 | `created_at` | `BIGINT NOT NULL` | Yes | Set once at INSERT |
-| `updated_at` | `BIGINT NOT NULL` | If mutable | Set at INSERT and every UPDATE |
-
-**Naming is uniform.** `created_at` and `updated_at` are the only names for row lifecycle time — not `recorded_at`, `created_at_ms`, or `updated_at_ms`. A column carrying *domain* time distinct from row birth (for example the originating event's creation instant on a money row) is named for that domain meaning and documented in its slot.
-
-**Mutable tables** (any table where UPDATE is a valid operation) must have `updated_at`.
-
-**Append-only/event tables** (where UPDATE is blocked by trigger or by design) are exempt from `updated_at`.
+| `updated_at` | `BIGINT NOT NULL` | If the row ever changes | Set at INSERT and every UPDATE |
 
 ## Audit Pattern
 
-- **Actor tracking:** Use `actor TEXT` in event/transition tables (e.g., `policy_events`, `usage_ledger`).
-- **No `updated_by` column.** Changes to mutable tables are tracked via separate event-sourced audit tables (e.g., `workspace_billing_audit`, `harness_change_log`), not inline `updated_by`.
-- **Append-only enforcement:** Tables that must never be updated should have a trigger:
+- **Actor tracking:** `actor TEXT` in event and transition tables.
+- **No `updated_by` column.** Changes to mutable tables are tracked in event tables, not inline.
+- **Append-only enforcement:** an immutable table refuses UPDATE by trigger; DELETE follows grants and the deletion matrix.
   ```sql
-  CREATE OR REPLACE FUNCTION core.{table}_append_only() RETURNS trigger AS $$
+  CREATE OR REPLACE FUNCTION {schema}.{table}_refuse_update() RETURNS trigger AS $$
   BEGIN
-      RAISE EXCEPTION '{table} is append-only — UPDATE and DELETE are not permitted';
+      RAISE EXCEPTION '{table} is append-only';
   END;
   $$ LANGUAGE plpgsql;
 
-  CREATE TRIGGER trg_{table}_append_only
-      BEFORE UPDATE OR DELETE ON core.{table}
-      FOR EACH ROW EXECUTE FUNCTION core.{table}_append_only();
+  CREATE TRIGGER trg_{table}_refuse_update
+      BEFORE UPDATE ON {schema}.{table}
+      FOR EACH ROW EXECUTE FUNCTION {schema}.{table}_refuse_update();
   ```
 
-## RNG
+## Randomness
 
-- **Always** use `std.crypto.random` (via `allocUuidV7` in `id_format.zig`).
-- **Never** use custom RNG implementations or `std.rand`.
+- Identifiers and secrets come from `afd_core::id` and the operating system's cryptographic source; never a custom random number generator.
 <!-- oracle-packs:end -->

package/docs/TEMPLATE.md

@@ -17,7 +17,7 @@ Three markup classes appear below the divider. The gate tells them apart mechani
 | `tpl:` guidance comment | How to fill the section — written for the authoring agent only | **Deleted after filling.** The gate BLOCKs any survivor. |
 | SPEC AUTHORING RULES banner comment | Standing constraints on the instance | The one comment that survives, verbatim. |
 
-Everything else — headings, table skeletons, the standard rubric rows — is kept and filled. The result: the executing agent reads **100% instance content, zero template noise**, and the 320-line budget buys signal, not boilerplate.
+Everything else — headings, table skeletons, the standard rubric rows — is kept and filled. The result: the executing agent reads **100% instance content, zero template noise**, and the 500-line budget buys signal, not boilerplate.
 
 ## What a spec pins
 
@@ -89,7 +89,7 @@ A milestone is not complete until evidence is captured: commands, logs, screensh
 
 ## Guardrails
 
-- **Length — hard upper bound 320 lines for the filled spec** (after `tpl:` comment deletion). Typical specs 150–300. Past the bound before the Acceptance Rubric → scope is two specs sharing one file; split.
+- **Length — hard upper bound 500 lines for the filled spec** (after `tpl:` comment deletion). Typical specs 150–350. Past the bound before the Acceptance Rubric → scope is two specs sharing one file; split.
 - **Sections** — 3–9. **Workstreams** — ≤4 (5th cross-cutting only).
 - **File naming** — `docs/v{N}/{pending|active|done}/M{N}_{NNN}_P{Priority}_{CATEGORIES}_{NAME}.md` (e.g. `M40_001_P0_API_WORKER_SUBSTRATE.md`). Categories alphabetised.
 

package/docs/greptile-learnings/RULES.md

@@ -409,7 +409,7 @@ another product's version number never authorizes a rebuild here.
 
 <!-- oracle-packs:start product.agentsfleet -->
 
-**Rule:** While `cat VERSION` < 0.30.0 (teardown-rebuild era), removing tables MUST be a full teardown: (1) delete the SQL file (`rm schema/NNN_foo.sql`), (2) remove the `@embedFile` constant from `schema/embed.zig`, (3) remove the migration array entry from `rustd/crates/afd_db/src/migration.rs` and update its registration tests. Never write ALTER TABLE, DROP TABLE, or `SELECT 1;` placeholders. Never keep version-marker files. Migration slot numbers are not sacred pre-v0.30 — the DB is wiped on every rebuild, and gaps in numbering are fine. From VERSION >= 0.30.0 the datastore is live production data, so every removal or reshape is a numbered ALTER/DROP migration and the teardown path is closed. **Compare the version field by field, never as a string:** `0.29.0` is under the anchor, `0.30.0` is not, and a lexical compare puts `0.30.0` below `0.9.0` — the anchor moved off a major-number boundary precisely so the minor field decides.
+**Rule:** While `cat VERSION` < 0.30.0 (teardown-rebuild era), removing tables MUST be a full teardown: (1) delete the SQL file (`rm schema/NNN_foo.sql`), (2) remove the migration array entry from `rustd/crates/afd_db/src/migration.rs` and update its registration tests. Never write ALTER TABLE, DROP TABLE, or `SELECT 1;` placeholders. Never keep version-marker files. Migration slot numbers are not sacred pre-v0.30 — the DB is wiped on every rebuild, and gaps in numbering are fine. From VERSION >= 0.30.0 the datastore is live production data, so every removal or reshape is a numbered ALTER/DROP migration and the teardown path is closed. **Compare the version field by field, never as a string:** `0.29.0` is under the anchor, `0.30.0` is not, and a lexical compare puts `0.30.0` below `0.9.0` — the anchor moved off a major-number boundary precisely so the minor field decides.
 **Why:** Markers accumulate dead code and still force CI to splitter-parse them. Below 0.30.0 the development database is dropped and re-created from empty, so there is no production data to protect and full removal leaves no false grep hits or stale migration slots. At 0.30.0 that stops being true: the deployment holds data nobody can re-create, which is what makes an in-place migration the only safe shape from then on.
 **Tags:** sql, process
 **Example:** harness teardown — supersedes prior "replace with `SELECT 1;`" guidance. Under the old rule, comment-only markers broke CI (apostrophe in "slots" opened unterminated string in splitter); full deletion avoids the marker problem entirely.
@@ -1004,7 +1004,7 @@ Never infer the absence of deployed clients from another product's version.
 - RPC / handler signature changes → edit the existing struct + every caller in the same commit. No `Foo` and `FooV2`.
 - "Versioned" / "additive optional fields" framing in a spec is fine — what's banned is a *parallel* type, not nullable extensions on the existing one.
 - Removing a behavior → delete the function, the call sites, and any dispatch arm that selected it. Tests of the removed path go too.
-- Schema removals already covered by the Schema Table Removal Guard (rm file, rm `@embedFile`, rm migration array entry) — that's this rule applied to SQL.
+- Schema removals already covered by the Schema Table Removal Guard (rm file, rm migration array entry) — that's this rule applied to SQL.
 - Legacy-Design Consult Guard still fires when you find a *pre-existing* legacy shim left over from the v1→v2 teardown. This rule says: don't create new ones.
 - Command-line renames follow the same rule: if the product verb moves to `create`, do not add `add` as an alias. If a flag or command spelling changes, use the new spelling only unless Indy explicitly asks for a compatibility alias in the same session.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/src/install_packs.test.ts

@@ -44,7 +44,7 @@ describe("opt-in pack selection", () => {
     const installed = await Promise.all(pages.map((path) => Bun.file(join(repo, ".orly", path)).text()));
     for (const content of installed) {
       expect(content).not.toContain("playbooks/founding/");
-      expect(content).not.toContain("schema/embed.zig");
+      expect(content).not.toContain("rustd/crates/afd_db/src/migration.rs");
       expect(content).not.toContain("src/cmd/common.zig");
       expect(content).not.toContain("build_runner.zig");
       expect(content).not.toContain("~/Projects/docs/");
@@ -73,7 +73,7 @@ describe("opt-in pack selection", () => {
     const sql = await Bun.file(join(repo, ".orly/dispatch/write_sql.md")).text();
     const zig = await Bun.file(join(repo, ".orly/dispatch/write_zig.md")).text();
     expect(sql).toContain("0.30.0");
-    expect(sql).toContain("schema/embed.zig");
+    expect(sql).toContain("rustd/crates/afd_db/src/migration.rs");
     expect(sql).toContain("**Forbidden:**");
     expect(zig).toContain("build_runner.zig");
   });

package/src/spec_template.test.ts

@@ -104,6 +104,13 @@ describe("spec content readiness", () => {
   });
 
   test("oversize specs report their measured size against the cap", () => {
-    expect(validateSpec(`${VALID}\n${"line\n".repeat(320)}`, COMMANDS, EXISTS).join("\n")).toMatch(/spec has \d+ lines; cap 320/);
+    expect(validateSpec(`${VALID}\n${"line\n".repeat(500)}`, COMMANDS, EXISTS).join("\n")).toMatch(/spec has \d+ lines; cap 500/);
+  });
+
+  test("a spec at the cap passes and one line over fails", () => {
+    const base = VALID.trimEnd();
+    const padded = (lines: number) => `${base}\n${Array(lines - base.split(/\r?\n/).length).fill("line").join("\n")}`;
+    expect(validateSpec(padded(500), COMMANDS, EXISTS).join("\n")).not.toMatch(/cap 500/);
+    expect(validateSpec(padded(501), COMMANDS, EXISTS)).toContain("spec has 501 lines; cap 500");
   });
 });