@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.25

package/dist/schedules/scheduled-tasks.service.js

@@ -9,7 +9,6 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { randomUUID } from "node:crypto";
 import { CHANNEL_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { AgentLookup } from "../agents/agent-lookup.js";
 import { ConversationAccess } from "../conversations/access.js";
@@ -18,16 +17,15 @@ import { ApiError } from "../errors.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import { orgAllows } from "../local-devices/network-grants.js";
 import { OrgLock } from "../orgs/org-lock.js";
 import { can, roleAtLeast } from "../orgs/roles.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { ProviderRegistry } from "../runtime/providers.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { isTimeZone } from "../time-zone.js";
@@ -36,7 +34,7 @@ import { assembleCalendar, CALENDAR_LIMITS, CALENDAR_RANGE_DAYS, CALENDAR_TASK_R
 import { readScheduleSettings } from "./effective-settings.js";
 import { grantNotAllowed, scheduleDisabled, scheduleForbidden, scheduleNotFound, targetInvalid, } from "./errors.js";
 import { grantRefusal, grantRefusalOf, isNetworkGrantKey, isPolicyGrantKey, isTierGrantKey, NETWORK_GRANT_PREFIX, NETWORK_GRANT_SPEC_HASH, networkGrantHost, networkGrantRefusal, TIER_GRANT_SPEC_HASH, tierGrantRefusal, } from "./grant-rules.js";
-import { schedFireJob } from "./job-ids.js";
+import { oweSchedFire, oweSchedSettleUnfired } from "./job-ids.js";
 import { pauseTaskIn } from "./pause.js";
 import { jitterForGap, minGapMinutes, nextTick, validateTrigger } from "./schedule-math.js";
 import { ScheduledTaskStore } from "./store.js";
@@ -75,14 +73,14 @@ let ScheduledTasksService = class ScheduledTasksService {
     extensions;
     providers;
     log;
-    maintenance;
+    outbox;
     sandbox;
     devicePolicy;
     constructor(db, txHost, config, store, orgLock, agents, access, tools, extensions, 
     /** A task's model must resolve for the org and declare its effort (as a message's switch). */
     providers, log, 
-    /** "Run now" enqueues the fire job (consumed by the worker role). */
-    maintenance, 
+    /** "Run now" owes the fire job (consumed by the worker role). */
+    outbox, 
     /** Network grants: the org's effective egress (network ask-to-allow spec §8.1). */
     sandbox, 
     /** Network grants: the task's device's local policy summary (`remoteGrants`). */
@@ -98,7 +96,7 @@ let ScheduledTasksService = class ScheduledTasksService {
         this.extensions = extensions;
         this.providers = providers;
         this.log = log;
-        this.maintenance = maintenance;
+        this.outbox = outbox;
         this.sandbox = sandbox;
         this.devicePolicy = devicePolicy;
     }
@@ -525,6 +523,8 @@ let ScheduledTasksService = class ScheduledTasksService {
             disabledTools: d.disabledTools ?? [],
             subagentTools: d.subagentTools,
             subagents: d.subagents,
+            // no conversation at hand: a web one's tools; a run elsewhere still refuses by spec.sources
+            source: "web",
         });
         const ctx = {
             role,
@@ -789,6 +789,8 @@ let ScheduledTasksService = class ScheduledTasksService {
                 disabledTools: d.disabledTools ?? [],
                 subagentTools: d.subagentTools,
                 subagents: d.subagents,
+                // no conversation at hand: a web one's tools; a run elsewhere still refuses by spec.sources
+                source: "web",
             });
             return new Map(tools.map((x) => [
                 x.key,
@@ -820,7 +822,7 @@ let ScheduledTasksService = class ScheduledTasksService {
     /**
      * "Run now" (spec §6), creator only: a task run for the request time, outside the schedule (no
      * unique-key conflict with a tick, and `next_run_at` does not move), fired at once through the
-     * fire job after the commit. `trial`: an attended trial run whose approvals become the task's
+     * fire job its transaction owes. `trial`: an attended trial run whose approvals become the task's
      * grants (§7). Counted in the rate limit like any run. An ended task cannot run; a paused one
      * can (only its creator gets here: the run is `manual`, which the fire's paused check lets by).
      */
@@ -850,10 +852,9 @@ let ScheduledTasksService = class ScheduledTasksService {
             target: task.id,
             detail: { taskRunId: run.id, trial: opts.trial },
         });
-        const job = schedFireJob(run.id);
-        afterCommit(async () => {
-            await this.maintenance.add(job.name, job.data, job.opts);
-        });
+        await oweSchedFire(this.outbox, run.id, orgId);
+        // a fire job that fails for good before its claim leaves the run to this check (`removed`)
+        await oweSchedSettleUnfired(this.outbox, run.id, orgId, run.scheduledFor, null);
         return run;
     }
     /** The live role of a member of the org; not a member → `schedule.not_found`. */
@@ -1083,6 +1084,8 @@ let ScheduledTasksService = class ScheduledTasksService {
             disabledTools: d.disabledTools ?? [],
             subagentTools: d.subagentTools,
             subagents: d.subagents,
+            // no conversation at hand: a web one's tools; a run elsewhere still refuses by spec.sources
+            source: "web",
         });
         for (const g of toolGrants) {
             const tool = tools.find((x) => x.key === g.toolKey);
@@ -1168,7 +1171,7 @@ ScheduledTasksService = __decorate([
     __param(8, Inject(ExtensionRegistry)),
     __param(9, Inject(ProviderRegistry)),
     __param(10, Inject(KERNEL_LOGGER)),
-    __param(11, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
+    __param(11, Inject(OutboxService)),
     __param(12, Inject(SandboxService)),
     __param(13, Inject(DevicePolicyService))
 ], ScheduledTasksService);

package/dist/schedules/schedules.module.js

@@ -11,10 +11,8 @@ import { Inject, Module } from "@nestjs/common";
 import { AgentLookupModule } from "../agents/agent-lookup.js";
 import { ConversationAccessModule } from "../conversations/access.js";
 import { ExtensionRegistryModule } from "../extensions/registry.js";
-import { QueueModule } from "../infra/queue/queue.module.js";
 import { LocalDevicesModule } from "../local-devices/local-devices.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { ProvidersModule } from "../runtime/providers.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { ScheduleToolsPort } from "../tools/builtins/schedules.js";
@@ -53,8 +51,6 @@ SchedulesModule = __decorate([
             // network grants: the org's effective egress and the task device's policy summary
             SandboxModule,
             LocalDevicesModule,
-            // "run now" enqueues the fire job
-            QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
         ],
         providers: [ScheduledTasksService],
         exports: [ScheduledTasksService, ScheduledTaskStoreModule],

package/dist/skills/changes.controller.d.ts

@@ -40,7 +40,7 @@ export declare class InboxController {
     private readonly inbox;
     constructor(inbox: InboxService);
     list(principal: Principal, org: OrgContext): Promise<InboxView>;
-    /** An org admin dismisses an org notice (`skill_renamed`) -> 204. */
+    /** An org admin dismisses an org notice -> 204. */
     dismissNotice(principal: Principal, org: OrgContext, params: z.infer<typeof NoticeParamsSchema>): Promise<void>;
 }
 export {};

package/dist/skills/changes.controller.js

@@ -86,7 +86,7 @@ let InboxController = class InboxController {
         const p = requireUser(principal);
         return this.inbox.list(org.orgId, p.account.id);
     }
-    /** An org admin dismisses an org notice (`skill_renamed`) -> 204. */
+    /** An org admin dismisses an org notice -> 204. */
     async dismissNotice(principal, org, params) {
         const p = requireUser(principal);
         await this.inbox.dismissNotice(org.orgId, p.account.id, params.id);

package/dist/tools/approvals.service.d.ts

@@ -338,11 +338,22 @@ export declare class ApprovalsService {
      */
     cancelPendingIn(runId: string): Promise<ApprovalRecord[]>;
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里指定由 `accountId` 处理（`requested_for`）的全部 pending 审批（成员离职），
-     * 走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、写 `approval_decided{cancelled}`（处理人为 null）。
-     * 返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件（并可续跑对应运行）。
+     * The conversations of `orgId` holding a pending approval `accountId` is asked to decide
+     * (`requested_for`), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    cancelPendingFor(orgId: string, accountId: string): Promise<{
+    pendingConversationsFor(orgId: string, accountId: string): Promise<string[]>;
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending approval of
+     * `orgId` that `accountId` is asked to decide (`requested_for`) in `conversationIds`, the
+     * conversations the caller already locked (by tree root first, `lockConversationTrees`; lock
+     * order: conversations, then approval rows), along the same path as {@link cancelPendingIn}:
+     * `cancelled`, `approval_decided{cancelled}` with no decider. An approval asked meanwhile in
+     * another conversation is left to its run's stop, so no conversation is locked after a row.
+     * Returns the cancelled records and the highest seq written per conversation; the caller
+     * publishes after the commit.
+     */
+    cancelPendingFor(orgId: string, accountId: string, conversationIds: readonly string[]): Promise<{
         records: ApprovalRecord[];
         seqs: Map<string, number>;
     }>;

package/dist/tools/approvals.service.js

@@ -13,6 +13,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { EventLog } from "../conversations/event-log.js";
 import { NETWORK_ASK_MAX_HOSTS, NETWORK_HOST_MAX_CHARS, } from "../conversations/events.js";
+import { conversationSourceOf } from "../conversations/source.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
@@ -814,6 +815,8 @@ let ApprovalsService = class ApprovalsService {
             disabledTools: def?.disabledTools ?? [],
             subagentTools: def?.subagentTools,
             subagents: def?.subagents,
+            // the tools of the trial run's conversation, where the approval was asked
+            source: await conversationSourceOf(t, a.conversationId),
         });
         const tool = tools.find((x) => x.key === a.toolKey);
         const { forbiddenTools } = await readScheduleSettings(t, this.config, a.orgId);
@@ -975,21 +978,34 @@ let ApprovalsService = class ApprovalsService {
         return out;
     }
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里指定由 `accountId` 处理（`requested_for`）的全部 pending 审批（成员离职），
-     * 走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、写 `approval_decided{cancelled}`（处理人为 null）。
-     * 返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件（并可续跑对应运行）。
+     * The conversations of `orgId` holding a pending approval `accountId` is asked to decide
+     * (`requested_for`), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    async cancelPendingFor(orgId, accountId) {
-        const t = this.db.db;
-        // the conversations first, in id order (lock order: conversation, then approval rows)
-        const convs = await this.lockConversations(t
+    async pendingConversationsFor(orgId, accountId) {
+        const rows = await this.db
             .selectFrom("approvals")
             .select("conversation_id")
+            .distinct()
             .where("org_id", "=", orgId)
             .where("requested_for", "=", accountId)
-            .where("status", "=", "pending"));
-        // only the conversations locked above: an approval asked meanwhile in another one is left to
-        // the run's stop or the sweep, so no conversation is locked after a row
+            .where("status", "=", "pending")
+            .execute();
+        return rows.map((r) => r.conversation_id);
+    }
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending approval of
+     * `orgId` that `accountId` is asked to decide (`requested_for`) in `conversationIds`, the
+     * conversations the caller already locked (by tree root first, `lockConversationTrees`; lock
+     * order: conversations, then approval rows), along the same path as {@link cancelPendingIn}:
+     * `cancelled`, `approval_decided{cancelled}` with no decider. An approval asked meanwhile in
+     * another conversation is left to its run's stop, so no conversation is locked after a row.
+     * Returns the cancelled records and the highest seq written per conversation; the caller
+     * publishes after the commit.
+     */
+    async cancelPendingFor(orgId, accountId, conversationIds) {
+        const t = this.db.db;
+        const convs = [...conversationIds];
         if (convs.length === 0)
             return { records: [], seqs: new Map() };
         const rows = await t

package/dist/tools/pipeline.d.ts

@@ -1,4 +1,4 @@
-import { type FormAnswer, type InputForm, type Logger } from "@capybara-hq/plugin-sdk";
+import { type ConversationSource, type FormAnswer, type InputForm, type Logger } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../agents/definition.js";
 import { EventLog } from "../conversations/event-log.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
@@ -222,8 +222,17 @@ export interface ToolStepContext {
     /** 运行所用的 agent 版本（审计链记录）。 */
     agentVersion: number;
     agent: AgentDefinition;
-    /** 对话发起人（取个人凭据、审计 actor）。 */
+    /** The run's trigger account (personal credentials, the audit actor). */
     accountId: string;
+    /**
+     * The conversation's source (memory plugin spec §6.2): extension tools limited by
+     * `spec.sources` are resolved with it, and plugin handlers receive it.
+     */
+    source: ConversationSource;
+    /** The conversation's owner (`conversations.account_id`), given to plugin handlers. */
+    ownerAccountId: string;
+    /** The trigger account's current org role, given to plugin handlers. */
+    role: OrgRole;
     /** run 的中止信号（用户中止 / 截止时间）。 */
     signal: AbortSignal;
     /** run 的截止时间（epoch 毫秒）；传给内置工具（沙箱命令据此收紧超时，Ruling M20）。 */

package/dist/tools/pipeline.js

@@ -314,6 +314,7 @@ let ToolPipeline = class ToolPipeline {
                     forkChild: ctx.parent?.forSkill === true,
                     sandboxConversationId: ctx.parent?.rootConversationId ?? ctx.conversationId,
                     replay: ctx.conversationKind === "eval",
+                    source: ctx.source,
                 });
             }
             return resolved;
@@ -1001,6 +1002,10 @@ let ToolPipeline = class ToolPipeline {
             conversationId: ctx.conversationId,
             callId,
             ...(resume !== undefined && { resume }),
+            // who and where (memory plugin spec §6.2): `accountId` stays the trigger account
+            source: ctx.source,
+            ownerAccountId: ctx.ownerAccountId,
+            role: ctx.role,
             ...(tool.source.kind === "builtin" && stepTools !== undefined && { tools: stepTools }),
             ...(tool.source.kind === "builtin" && { runId: ctx.runId }),
             ...(tool.source.kind === "builtin" &&

package/dist/tools/questions.service.d.ts

@@ -105,11 +105,22 @@ export declare class QuestionsService {
      */
     cancelPendingIn(runId: string): Promise<QuestionRecord[]>;
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里由 `accountId` 发起的运行上的全部 pending 输入请求（只有运行发起人能回答，
-     * 即「其作为处理人」的提问；成员离职时调用），走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、
-     * 写 `question_answered{cancelled}`。返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件。
+     * The conversations of `orgId` holding a pending question of a run `accountId` started (only the
+     * run's starter answers), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    cancelPendingFor(orgId: string, accountId: string): Promise<{
+    pendingConversationsFor(orgId: string, accountId: string): Promise<string[]>;
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending question of a run
+     * `accountId` started in `orgId` within `conversationIds`, the conversations the caller already
+     * locked (by tree root first, `lockConversationTrees`; lock order D7: conversation, then question
+     * rows), along the same path as {@link cancelPendingIn}: `cancelled`,
+     * `question_answered{cancelled}`. A question asked meanwhile in another conversation waits for
+     * its run's stop (offboarding owes it), so no conversation is locked after a row. Returns the
+     * cancelled records and the highest seq written per conversation; the caller publishes after the
+     * commit.
+     */
+    cancelPendingFor(orgId: string, accountId: string, conversationIds: readonly string[]): Promise<{
         records: QuestionRecord[];
         seqs: Map<string, number>;
     }>;

package/dist/tools/questions.service.js

@@ -324,14 +324,12 @@ let QuestionsService = class QuestionsService {
         return out;
     }
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里由 `accountId` 发起的运行上的全部 pending 输入请求（只有运行发起人能回答，
-     * 即「其作为处理人」的提问；成员离职时调用），走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、
-     * 写 `question_answered{cancelled}`。返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件。
+     * The conversations of `orgId` holding a pending question of a run `accountId` started (only the
+     * run's starter answers), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    async cancelPendingFor(orgId, accountId) {
-        const t = this.db.db;
-        // the conversations first, in id order (lock order D7: conversation, then question rows)
-        const convs = await t
+    async pendingConversationsFor(orgId, accountId) {
+        const rows = await this.db
             .selectFrom("questions")
             .select("conversation_id")
             .distinct()
@@ -339,24 +337,28 @@ let QuestionsService = class QuestionsService {
             .where("status", "=", "pending")
             .where("run_id", "in", (eb) => eb.selectFrom("runs").select("id").where("trigger_account_id", "=", accountId))
             .execute();
-        if (convs.length > 0) {
-            await t
-                .selectFrom("conversations")
-                .select("id")
-                .where("id", "in", convs.map((c) => c.conversation_id))
-                .orderBy("id")
-                .forUpdate()
-                .execute();
-        }
-        // only the conversations locked above: a question asked meanwhile in another one waits for
-        // the run's stop (offboarding aborts it) or the sweep, so no conversation is locked after a row
+        return rows.map((r) => r.conversation_id);
+    }
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending question of a run
+     * `accountId` started in `orgId` within `conversationIds`, the conversations the caller already
+     * locked (by tree root first, `lockConversationTrees`; lock order D7: conversation, then question
+     * rows), along the same path as {@link cancelPendingIn}: `cancelled`,
+     * `question_answered{cancelled}`. A question asked meanwhile in another conversation waits for
+     * its run's stop (offboarding owes it), so no conversation is locked after a row. Returns the
+     * cancelled records and the highest seq written per conversation; the caller publishes after the
+     * commit.
+     */
+    async cancelPendingFor(orgId, accountId, conversationIds) {
+        const t = this.db.db;
+        const convs = [...conversationIds];
         if (convs.length === 0)
             return { records: [], seqs: new Map() };
         const rows = await t
             .selectFrom("questions")
             .selectAll()
             .where("org_id", "=", orgId)
-            .where("conversation_id", "in", convs.map((c) => c.conversation_id))
+            .where("conversation_id", "in", convs)
             .where("status", "=", "pending")
             .where("run_id", "in", (eb) => eb.selectFrom("runs").select("id").where("trigger_account_id", "=", accountId))
             .orderBy("created_at")

package/dist/tools/registry.d.ts

@@ -1,4 +1,4 @@
-import type { Connector, HookParentScope, InputRequired, NetworkBlockedHost, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
+import type { Connector, ConversationSource, HookParentScope, InputRequired, NetworkBlockedHost, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
 import { type AgentDefinition, type DisabledToolRef, type SubagentTools } from "../agents/definition.js";
 import type { ToolView } from "../conversations/events.js";
 import { EffectiveConfigs } from "../extensions/effective-config.js";
@@ -213,6 +213,8 @@ export declare function withoutDisplayFields<T>(spec: T): T;
 export declare function specHash(spec: unknown): string;
 /** 由注解推导默认策略：只读 → allow；其余（破坏性 / 无注解）→ ask。 */
 export declare function policyFromAnnotations(a: ToolAnnotations | undefined): "allow" | "ask";
+/** Why an extension tool limited by `spec.sources` is not offered in a `source` conversation. */
+export declare const sourceHiddenReason: (source: ConversationSource) => string;
 /** `forAgent` 的结果。 */
 export interface AgentTools {
     tools: ResolvedTool[];
@@ -362,6 +364,11 @@ export declare class ToolRegistry {
         sandboxConversationId?: string;
         /** An eval replay's listing: its calls are never executed (the sandbox tools are listed). */
         replay?: boolean;
+        /**
+         * The conversation's source (memory plugin spec §6.2): an extension tool whose
+         * `spec.sources` leaves it out is hidden. Required, so nothing defaults to the widest.
+         */
+        source: ConversationSource;
     }): Promise<AgentTools>;
     /** 是否启用 `ToolSearch`（见 {@link forAgent}）；先比阈值，超过才读组织设置。 */
     private searchActive;

package/dist/tools/registry.js

@@ -59,6 +59,8 @@ export function specHash(spec) {
 export function policyFromAnnotations(a) {
     return a?.readOnlyHint === true ? "allow" : "ask";
 }
+/** Why an extension tool limited by `spec.sources` is not offered in a `source` conversation. */
+export const sourceHiddenReason = (source) => `Not available in ${source} conversations`;
 // `ToolSearch` is added by the registry by org setting and threshold, `Skill` when the log has a
 // skills catalog snapshot; neither comes from agent definitions (`./builtin-names.ts`).
 /** 工具定义（模型可见三项）的估算 token 数（与请求估算同一口径）。 */
@@ -348,6 +350,7 @@ let ToolRegistry = class ToolRegistry {
     }
     async resolve(orgId, def) {
         const disabled = def.disabledTools ?? [];
+        const { source } = def;
         const scope = {
             orgId,
             ...(def.sandboxConversationId !== undefined && {
@@ -435,6 +438,12 @@ let ToolRegistry = class ToolRegistry {
                     hidden.push({ ref: key, reason: toolTurnedOffReason(key) });
                     continue;
                 }
+                // offered only in some conversation sources; the source never changes, so this also
+                // refuses a resumed call (the pipeline resolves the step's tools with the same source)
+                if (t.spec.sources !== undefined && !t.spec.sources.includes(source)) {
+                    hidden.push({ ref: key, reason: sourceHiddenReason(source) });
+                    continue;
+                }
                 if (!(await configuredIn(t.plugin))) {
                     hidden.push({ ref: key, reason: `Plugin ${t.plugin} ${NEEDS_CONFIG_REASON}` });
                     continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.24",
+  "version": "0.1.0-rc.25",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.18"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.19"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
@@ -74,7 +74,7 @@
     "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
     "ws": "^8.22.0",
-    "@capybara-hq/testing": "0.1.0-rc.16"
+    "@capybara-hq/testing": "0.1.0-rc.17"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0121_drop_platform_migration_runs.sql

@@ -0,0 +1,12 @@
+-- 0121, transactional outbox spec §8.2: the platform components migration job is gone (an import
+-- writes its platform components in its transaction), so nothing writes its runs table any more and
+-- the platform inbox no longer shows a run; the org notice kind `skill_renamed`, which only that job
+-- wrote, goes with it.
+-- capybara:allow-destructive the job that wrote this table is removed in this release and nothing reads it (project not released, no compatibility layer)
+DROP TABLE IF EXISTS platform_migration_runs;
+-- capybara:allow-destructive notices of a kind only the removed job wrote; the inbox no longer renders the kind (project not released)
+DELETE FROM org_notices WHERE kind = 'skill_renamed';
+-- capybara:allow-destructive the check is added back without `skill_renamed` in the next statement; no row has that kind any more
+ALTER TABLE org_notices DROP CONSTRAINT IF EXISTS org_notices_kind_check;
+ALTER TABLE org_notices ADD CONSTRAINT org_notices_kind_check
+  CHECK (kind IN ('item_shared', 'shared_item_updated', 'upload_confirmed', 'upload_rejected'));

package/src/migrations/0122_drop_scheduled_task_runs_rechecked_at.sql

@@ -0,0 +1,5 @@
+-- 0122, transactional outbox spec §8.1 / §8.2: the transaction that writes a pending task run owes
+-- its fire job in the outbox, so the scheduled task scan's repair is gone, and with it the column
+-- that rotated the repair's rechecks of started runs.
+-- capybara:allow-destructive the repair that read and wrote this column is removed in this release and nothing else reads it (project not released, no compatibility layer)
+ALTER TABLE scheduled_task_runs DROP COLUMN IF EXISTS rechecked_at;

package/src/migrations/0123_pgvector.sql

@@ -0,0 +1,27 @@
+-- pgvector, when the server offers it (memory plugin spec §6.4). Plugins store embeddings in a
+-- `vector` column when the type is visible from their search_path (`plugin_<name>, public`) and fall
+-- back to `real[]` otherwise, so pgvector is recommended, not required:
+-- - not offered by the server (no row in pg_available_extensions): nothing to do;
+-- - already installed, in whatever schema a DBA put it: left where it is;
+-- - refused (insufficient_privilege: the migrating role may not create it; feature_not_supported:
+--   a managed server lists it but its vendor allow-list refuses it, e.g. Azure Flexible Server):
+--   a notice naming the SQLSTATE, the migration succeeds. Any other error still fails it.
+-- `SCHEMA public` matters: the migrator's search_path is `capybara, public`, and a bare
+-- CREATE EXTENSION would put the type and `<=>` in `capybara`, invisible to plugin schemas.
+-- capybara:allow-destructive not destructive: a DO block is the only way to make CREATE EXTENSION conditional on availability and to turn a refused CREATE EXTENSION into a notice
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'vector') THEN
+    RAISE NOTICE 'pgvector is not available on this server; plugins fall back to real[] embeddings';
+    RETURN;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+    RETURN;
+  END IF;
+  BEGIN
+    EXECUTE 'CREATE EXTENSION IF NOT EXISTS vector SCHEMA public';
+  EXCEPTION WHEN insufficient_privilege OR feature_not_supported THEN
+    RAISE NOTICE 'pgvector not installed: CREATE EXTENSION was refused (SQLSTATE %: %); plugins fall back to real[] embeddings', SQLSTATE, SQLERRM;
+  END;
+END
+$$;

package/src/migrations/0124_conversation_source.sql

@@ -0,0 +1,36 @@
+-- Memory plugin spec §6.2: where a conversation comes from (web, channel_dm, channel_group,
+-- subagent), set once at creation and never changed; extension tools and context@1 providers are
+-- offered by it.
+-- The column is added with a constant default, so existing rows read 'web' without a rewrite.
+-- The backfill then sets the other sources, each UPDATE touching only rows still at 'web', so a
+-- re-run updates nothing; later UPDATEs skip rows an earlier one set:
+-- 1. kind 'subagent' -> subagent;
+-- 2. a channel thread row of any archive state (DM /new archives the row, the conversation stays
+--    a DM's): only 'dm:' keys -> channel_dm, any other key -> channel_group (a conversation with
+--    both is a group's: the safer of the two);
+-- 3. a scheduled group run whose thread is still to bind at its first post (no thread row yet):
+--    its delivery's target chat type.
+-- The rest stays web. The CHECK is added last (dropped first, so a re-run re-adds it).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS source text NOT NULL DEFAULT 'web';
+
+UPDATE conversations SET source = 'subagent'
+WHERE kind = 'subagent' AND source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN t.dm THEN 'channel_dm' ELSE 'channel_group' END
+FROM (
+  SELECT conversation_id, bool_and(thread_key LIKE 'dm:%') AS dm
+  FROM channel_threads
+  GROUP BY conversation_id
+) t
+WHERE t.conversation_id = c.id AND c.source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN d.target->>'chatType' = 'dm' THEN 'channel_dm' ELSE 'channel_group' END
+FROM channel_deliveries d
+WHERE d.conversation_id = c.id AND d.target->>'chatType' IN ('dm', 'group') AND c.source = 'web';
+
+-- capybara:allow-destructive the CHECK is re-added unchanged right below (a re-run of this file)
+ALTER TABLE conversations DROP CONSTRAINT IF EXISTS conversations_source_check;
+ALTER TABLE conversations ADD CONSTRAINT conversations_source_check
+  CHECK (source IN ('web', 'channel_dm', 'channel_group', 'subagent'));